Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Hosted Account Experience breaks OAuth: consent page crash (RSC null deref) + COOP severs popup clients

Abierto
  • ¿Algo no está bien?
#451 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
38/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Área
authentication, security

Línea de trabajo

Empieza reproduciendo el flujo del popup de OpenAI contra la Account Experience alojada e inspecciona las cabeceras de respuesta de la URL de inicio de sesión con curl. Después, sigue la página Reauthenticate en la UI alojada usando el error de consola indicado t.reason.enqueueModel. Se considera terminado cuando el popup conserva su opener durante la autorización y la página alojada se completa sin la desreferencia nula indicada.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
Preflight checklist
Ory Network Project

https://tender-satoshi-rtd7nibdhq.projects.oryapis.com

Describe the bug

OpenAI's public plugin-submission flow requires an MCP tool scan before a plugin can be submitted for review. The scanner successfully discovers our MCP protected-resource metadata, then starts OAuth authorization in a popup.

As soon as the popup navigates to Ory Network's hosted Account Experience, the OpenAI parent page reports:

MCP authorization failed: OAuth flow canceled.

The popup was not canceled or closed. It remains open on Ory's "Reauthenticate" page at https://auth.themolt.net/login?flow=….

The hosted response contains:

Cross-Origin-Opener-Policy: same-origin
Ory-Network-Ingress: T

That COOP policy separates the cross-origin popup into another browsing-context group and severs its opener relationship. OpenAI consequently observes the popup as closed/canceled. No authenticated MCP tools/list request occurs, so the mandatory scan remains incomplete and submission is blocked.

When continuing the login manually, the hosted Account Experience has also displayed:

This page couldn't load
Reload to try again, or go back.

with this browser console error:

TypeError: null is not an object (evaluating 't.reason.enqueueModel')

Could Ory change OAuth login/consent pages to Cross-Origin-Opener-Policy: same-origin-allow-popups, expose a project-level setting for this header, or document another supported configuration for OAuth popup clients? Please also investigate the hosted UI crash.

Reproducing the bug
  1. Configure an MCP server protected by Ory Network OAuth2/OIDC and dynamic client registration.
  2. In OpenAI's public plugin-submission portal, provide the MCP URL and select Scan Tools. This scan is mandatory before Submit for Review is enabled.
  3. OpenAI successfully requests GET /.well-known/oauth-protected-resource/mcp and determines OAuth is required.
  4. Select Authorize MCP → Continue.
  5. OpenAI opens the authorization flow in a popup.
  6. The popup navigates to https://auth.themolt.net/login?flow=… and shows Ory's Reauthenticate UI.
  7. The parent OpenAI page immediately reports MCP authorization failed: OAuth flow canceled., while the popup remains open.
  8. If login is continued manually, the Ory-hosted page may instead render This page couldn't load with the t.reason.enqueueModel error.

Expected: the popup remains connected to its opener, completes authorization, returns to OpenAI's callback, and allows the MCP tool scan to call tools/list.

Actual: the opener relationship is severed on navigation to the hosted Account Experience, OpenAI treats OAuth as canceled, and the required scan cannot run.

Relevant log output
OpenAI parent page:
MCP authorization failed: OAuth flow canceled.

Ory Account Experience error:
This page couldn't load
Reload to try again, or go back.

Browser console:
TypeError: null is not an object (evaluating 't.reason.enqueueModel')

Observed response headers from curl -I https://auth.themolt.net/login:
cross-origin-opener-policy: same-origin
ory-network-ingress: T

MCP-side sequence:
POST /mcp -> 415 initial scanner probe
GET /.well-known/oauth-protected-resource/mcp -> 200
No authenticated /mcp request follows.
Relevant configuration
Ory Network project:
https://tender-satoshi-rtd7nibdhq.projects.oryapis.com

Custom domain:
https://auth.themolt.net

DNS (OVH, direct CNAME; no customer-controlled proxy):
auth.themolt.net CNAME tender-satoshi-rtd7nibdhq.projects.oryapis.com

MCP server:
https://mcp.themolt.net/mcp

OAuth client:
- dynamic client registration
- authorization_code and refresh_token grants
- PKCE-compatible public client
- ChatGPT callback redirect URI
- token_endpoint_auth_method: none
Version

Ory Network hosted Account Experience, current on 2026-09-01

On which operating system are you observing this issue?

macOS

In which environment are you deploying?

Ory Network

Additional Context

The same MCP server and Ory authorization flow work through the normal ChatGPT connector. Discovery, dynamic registration, redirect URI registration, PKCE, and the authorization-code grant configuration are working. The failure is specific to OpenAI's mandatory plugin-submission scanner, which monitors a popup lifecycle.

Related but distinct: https://github.com/ory/elements/issues/587 reports a hosted consent redirect failure. This report concerns the hosted Account Experience/Network response header severing an OAuth popup, plus the separate t.reason.enqueueModel runtime failure.

The issue was drafted with Codex from captured browser, HTTP-header, OAuth-client, and server-log evidence.

Lenguaje dominante
Shell
Estrellas
96
Forks
8
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de ory/network

Todos los issues de ory/network

Issues similares

Más issues de Shell/Bash

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.