[2026-07-28] Authorization hardening (OAuth/OIDC)

Open

#338 opened on May 26, 2026 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 5/5
Estimated time: Over a week
Newbie friendliness: 25/100

Issue type: Feature
Clarity: Needs clarification
Activity status: Quiet
Tech stack: php
Domain: authentication, security

Research direction

Start by reviewing sub-issues #360–#364 and the related OAuth backlog #315–#326, then read the linked SEP references and existing authorization implementation. This tracking issue is complete when its five sub-issues are resolved and the listed PRM and WWW-Authenticate audits are finished.

Written by the indexing model from the issue text.

Description

2026-07-28 auth Client enhancement improves spec compliance Server

Tracking issue for the MCP Spec 2026-07-28 release — Authorization hardening milestone.

Most of this milestone overlaps with the existing client-OAuth backlog (#315–#326). New SEP-specific work concentrates on issuer validation, AS-binding semantics, server-side scope emission, and OIDC offline_access handling.

SEPs covered

SEP	Title	Spec PR	Coverage
SEP-2468	Recommend `iss` Parameter (RFC 9207)	#2468	New issue
SEP-2352	Authorization Server binding and migration	#2352	New issue
SEP-2351	RFC 8414 well-known URI suffix	#2351	Covered by #318
SEP-2350	Client-side scope accumulation in step-up	#2350	Client covered by #322; new server-side issue
SEP-2207	OIDC-flavored refresh token guidance	#2207	New issues (client + server)
SEP-837	OIDC `application_type` during DCR	#837	Covered by #320 + #321

Sub-issues

#360 — SEP-2468: Validate iss parameter in authorization response (client)
#361 — SEP-2352: Key DCR/tokens by AS issuer; reject cross-AS reuse (client)
#362 — SEP-2350: Emit per-operation scopes in insufficient_scope 403 responses (server)
#363 — SEP-2207: Request offline_access against OIDC-flavored AS (client)
#364 — SEP-2207: Audit PRM to ensure offline_access is not advertised as required (server)

Existing issues to annotate with SEP refs

#315 (TokenStorage) → SEP-2352
#318 (RFC 8414 AS metadata) → SEP-2351
#319 (Auth Code + PKCE) → SEP-2468, SEP-2207
#320 (DCR) → SEP-2352, SEP-837
#321 (token_endpoint_auth_method) → SEP-837
#322 (scope handling/step-up) → SEP-2350
#323 (refresh_token grant) → SEP-2207

Notes

All six SEPs are merged.
PHP SDK client-side OAuth is largely unimplemented; the bulk of work is therefore on the client side via the existing #315–#326 backlog plus the new SEP-specific issues above. Server-side OAuth middleware needs targeted PRM/WWW-Authenticate audits only.

Dominant language: PHP
Stars: 1.6k
Forks: 173
Avg merge: 2d 49m
Merged PRs (30d): 23

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

google-cloud-php: remove format step from owlbot.py now that librarian runs formatting during generate Open

priority: p3

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

googleapis/librarian#7636 · Opened Sep 21, 2026
occ fulltextsearch:document:index without --collection throws Exception before v35 Open

0. Needs triage bug

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

nextcloud/fulltextsearch#1011 · Opened Sep 21, 2026
bench results do not distinguish mirror-cold from network-cold Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

svandragt/vivace#292 · Opened Sep 21, 2026
Narrow argument types in the new Pagination\Window class in ORM 3.7 Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

phpstan/phpstan-doctrine#794 · Opened Sep 21, 2026
Homeboy findings in static-site-importer Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

Automattic/static-site-importer#1767 · Opened Sep 21, 2026

More PHP issues