OAuth callback does not validate the RFC 9207 iss parameter
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 69/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
- Domain
- authentication
Research direction
Read src/routes/auth-routes.ts and src/auth/oauth-client.ts, then trace how discovery metadata and the authorization callback are handled. Check the OAuth route tests for issuer metadata and callback validation. Done means the callback compares iss with the discovered issuer, requires it when metadata says it is supported, and rejects a mismatch before making the token request.
Written by the indexing model from the issue text.
Description
2026-07-28 makes RFC 9207 mandatory for clients (authorization.md: "MCP clients MUST apply the validation in RFC9207 Section 2.4 before transmitting the authorization code to any token endpoint", SEP-2468). The OAuth helper routes do not record the authorization server's issuer from discovery and /oauth/callback ignores iss: with authorization_response_iss_parameter_supported: true in the metadata, /oauth/callback?code=C&state=<valid>&iss=https://other.example still redeems the code (src/routes/auth-routes.ts, src/auth/oauth-client.ts).
The callback should compare iss with the recorded issuer (and require it when the metadata says it is supported) before the token request.
🤖 Generated with Claude Code
- Dominant language
- TypeScript
- Stars
- 63
- Forks
- 16
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 56
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from platformatic/mcp
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
platformatic/mcp#388 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
platformatic/mcp#387 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
platformatic/mcp#382 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
platformatic/mcp#381 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
platformatic/mcp#378 ·
Maintainers usually reply within 1 day
All issues in platformatic/mcp
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Open-Earth-Foundation/CityCatalyst#3399 ·
Maintainers usually reply within 2 days
-
userReport
Difficulty 1/5 Under an hour Newbie friendliness 72/100
nkprasad12/morcus-net#631 ·
Maintainers usually reply within 1 day
-
fix(app): fail closed if GetGeneralSetting fails during initializationPossibly taken @kalavt claimed this today. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
nekko-labs/nekko-agent#1756 ·
Maintainers usually reply within 1 day
-
needs-area-label
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 2 days