Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

OAuth redirect URI port mismatch breaks login to most MCP servers

Đang mở
  • Có gì không ổn?
#4,968 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
52/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
node.js
Lĩnh vực
authentication, cli

Hướng nghiên cứu

Start with the /mcp add OAuth flow and inspect the published client-metadata.json alongside the loopback listener in the shipped SEA binary. Compare the advertised redirect URI with the runtime redirect_uri, then verify the chosen behavior against a strict-matching MCP OAuth server and the RFC 8252 loopback requirement.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

triage

OAuth redirect URI port mismatch breaks login to most MCP servers

Summary

copilot CLI publishes a CIMD (Client ID Metadata Document) that declares a
single loopback redirect URI on a fixed port, but at runtime the CLI binds an
ephemeral loopback port and sends that port in the OAuth redirect_uri
parameter. GitHub's own OAuth server accepts the mismatch (per RFC 8252 §7.3
loopback matching), but many third-party OAuth servers — including
Entra/Azure-fronted MCP servers — do strict string matching against the
registered redirect_uris and reject the request.

The result is that authentication fails against almost every non-GitHub MCP
server users try to connect. Claude Code and Codex CLI are not affected in
the same environments.

Environment

  • CLI version: GitHub Copilot CLI 1.0.88
  • OS: macOS (arm64)
  • Install: Homebrew cask copilot-cli (SEA binary)

Reproducer

  1. Configure any MCP server whose OAuth authorize endpoint validates
    redirect_uri by exact match against the CIMD's redirect_uris list.
    (Entra/Azure-fronted services typically behave this way.)
  2. Trigger the OAuth flow from Copilot CLI:
    /mcp add <server-url> (or however the server is registered), then log in.
  3. The browser lands on the authorize endpoint, which returns:
{
  "error": "invalid_request",
  "error_description": "Redirect URI 'http://127.0.0.1:52752/' does not match CIMD redirect_uris.",
  "state": "..."
}

The port (52752 above) changes on every attempt.

Expected behavior

The redirect_uri sent to the authorize endpoint should either:

  • (a) match the port published in the CIMD, i.e. http://127.0.0.1:33418/, so
    strict-matching servers accept it; or
  • (b) rely on RFC 8252 §7.3 loopback matching and have the CIMD advertise
    http://127.0.0.1/ (no port), making clear to server implementers that
    port-agnostic matching is expected.

Today it does neither: it publishes a specific port and then uses a different
one.

Actual behavior / root cause

The CLI's published metadata at
https://github.com/copilot/cli/client-metadata.json:

{
  "client_id": "https://github.com/copilot/cli/client-metadata.json",
  "client_name": "GitHub Copilot CLI",
  "application_type": "native",
  "redirect_uris": ["http://127.0.0.1:33418/"],
  ...
}

But the CLI's OAuth loopback listener is bound with port 0 (verifiable by
inspecting the SEA blob inside the shipped binary):

// Port 0 = let the OS pick a free ephemeral port. Bind to loopback only.
await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
const address = server.address();
const port = typeof address === "object" && address ? address.port : 0;

The dynamically-assigned port then flows into the OAuth redirect_uri, which
never equals 33418.

Impact

  • Blocks Copilot CLI from authenticating against most third-party MCP servers,
    which is a large and growing set as MCP adoption widens.
  • Internal reports at multiple organisations indicate the same failure pattern
    across every non-GitHub MCP they've tried, with Claude Code / Codex CLI
    unaffected in the same environments.
  • Users have no clean local workaround. The one lever we found —
    COPILOT_MCP_CIMD_CLIENT_ID_URL overriding the CIMD document URL — requires
    self-hosting a metadata file that enumerates every ephemeral loopback port,
    which is fragile and requires the MCP server to dynamically trust arbitrary
    CIMDs.

Suggested fixes (either is sufficient)

  1. Bind the published port. Change the listener to
    server.listen(33418, "127.0.0.1", …) with a fallback strategy (retry with
    an ephemeral port only if 33418 is in use, and clearly document the
    fallback), so the common case matches the CIMD exactly.
  2. Publish port-agnostic CIMD. Change redirect_uris in
    client-metadata.json to ["http://127.0.0.1/"] and rely on the RFC 8252
    §7.3 loopback rule. This shifts the responsibility to non-conformant OAuth
    servers, which is arguably correct, but will not fix real-world usage until
    those servers are updated.

Option 1 is the most defensive; option 2 is the most spec-pure. A combination
(bind 33418 first, publish 127.0.0.1/) would maximise interoperability.

References

  • RFC 8252 §7.3 (Loopback Interface Redirection): loopback redirects SHOULD be
    matched ignoring the port component.
  • OAuth 2.0 for Native Apps client identity metadata document (CIMD) spec.

Drafted with GitHub Copilot CLI.

Ngôn ngữ chính
Shell
Star
11.2k
Fork
1.9k
Merge trung bình
17 giờ 6 phút
Pull request đã merge (30 ngày)
5

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của github/copilot-cli

Tất cả issue của github/copilot-cli

Issue tương tự

Thêm issue về Shell/Bash

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.