Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

PKCE verification: 2025-11-25 requires refusing when `code_challenge_methods_supported` is absent, which conflicts with the #832 / #992 resolution

オープン
  • 何か問題がありますか？
#2,831 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
28/100
issue の種類
機能追加
明瞭さ
説明が足りない
活発さ
活発
技術スタック
typescript
領域
authentication, security

調査の方向性

startAuthorization、OAuthMetadataSchema、OpenIdProviderDiscoveryMetadataSchema、および issue に記載された auth() の再現から始めてください。まず、提案された4つのポリシーのうちどれが求められているかを明確にしてください。完了とは、存在しない code_challenge_methods_supported フィールドに対して選択した動作が実装され、その逸脱または厳格性が文書化されていることを意味します。

索引モデルが issue の本文から書いたものです。

説明

v1 v2

Summary

This is a follow-up to #832 and #992, not a report that the check is missing — it is deliberately
permissive, and this is about the spec moving underneath that decision.

#992 made startAuthorization treat an absent code_challenge_methods_supported as "assume PKCE is
supported", to unblock Azure AD and AWS Cognito, whose OIDC discovery documents omit the field while
the providers do support S256. The reasoning in #832 was explicitly "if the list isn't present,
assume it's there, and rely on the requests later failing if you send PKCE parameters that the AS
doesn't support."

The MCP specification has since taken the opposite position. The 2025-11-25 revision's
"Authorization Code Protection" section requires clients to verify PKCE support from
authorization-server metadata and to refuse when the field is absent — stated separately for RFC
8414 metadata and for OpenID Connect Discovery, the latter precisely because OIDC provider metadata
does not define the field. It also tells OIDC providers to publish it for MCP compatibility.

The 2025-06-18 revision does not mention code_challenge_methods_supported at all, so this
requirement post-dates #992. The SDK currently implements the #992 behavior and therefore does not
satisfy the 2025-11-25 requirement.

Current behavior

@modelcontextprotocol/client 2.0.0, startAuthorization:

if (metadata.code_challenge_methods_supported &&
    !metadata.code_challenge_methods_supported.includes(AUTHORIZATION_CODE_CHALLENGE_METHOD)) {
  throw new Error(`Incompatible auth server: does not support code challenge method ...`);
}

The leading truthiness check makes an absent field a no-op. At the schema level the field is
.optional() on OAuthMetadataSchema, and OpenIdProviderDiscoveryMetadataSchema picks that same
optional field, so an OIDC document without it parses clean and proceeds to authorization.

Reproduction

Serve authorization-server metadata with no code_challenge_methods_supported (issuer,
authorization_endpoint, token_endpoint, response_types_supported: ["code"]) and run the
auth() flow. It completes; nothing is raised or surfaced.

Why this is worth revisiting rather than closing

The #832 rationale holds for the common case and I am not arguing it should be reverted: PKCE
parameters are still sent, so a server that supports PKCE but omits the advertisement remains fully
protected. The gap is narrower than "no PKCE".

What the current behavior cannot do is distinguish that server from one that ignores code_challenge
outright, and it gives an embedder no signal that the distinction was unresolvable. "Rely on the
requests later failing" does not hold for this specific failure mode: an authorization server with
no PKCE support does not reject a request carrying code_challenge, it ignores the parameter, and
the flow succeeds with the protection silently absent.

Possible resolutions

  1. Surface the condition without changing the flow — a documented callback, a warning, or a field on
    the returned discovery state — so embedders can apply their own policy. This preserves #992 and is
    the smallest change.
  2. An opt-in strict mode that refuses, defaulting to today's behavior.
  3. Refuse as the spec requires, with an opt-out for the OIDC case. Spec-correct, but reintroduces the
    #832 breakage as the default.
  4. Document the deviation from 2025-11-25 explicitly, so embedders know the check is theirs to make.

We implemented (1) plus (2) at the gateway layer and would be happy to send a PR for whichever
direction you prefer here.

Environment

@modelcontextprotocol/client 2.0.0 (latest at time of filing).

主要言語
TypeScript
スター
13.6k
フォーク
2.3k
平均マージ
1日 15時間
マージ済み PR（30日）
51

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

modelcontextprotocol/typescript-sdk のほかの issue

modelcontextprotocol/typescript-sdk の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。