MCP Oauth fails when the server metadata URL is redirected
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 55/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- shell
- 领域
- authentication, cli, security
调研方向
让 MCP 服务器的 .well-known/openid-configuration 返回 301 重定向，以重现该故障，然后跟踪 /mcp add HTTP 流程使用的 issuer 验证。完成标准是：当重定向 URL 的 issuer 与该最终 URL 匹配时，接受来自该 URL 的元数据，并且身份验证继续到浏览器或显示授权码。
由索引模型根据 Issue 内容生成。
描述
Describe the bug
When the .well-known/openid-configuration is behind an http redirect, authentication fails with:
Authentication failed: MCPOAuthError: Incompatible authorization server: authorization server advertised an issuer that does not match the URL its metadata was discovered from (RFC 8414 §3.3); refusing to connect
I believe that copilot-cli checks the issuer against the original URL instead of the redirected URL. Note that RFC 8414 states that the issuer must match "the URL used to retrieve the metadata," which strictly speaking is the redirection target, not the source.
Affected version
GitHub Copilot CLI 1.0.83.
Steps to reproduce the behavior
- Run an MCP server on a different server from its OAuth authorization server, e.g. https://my.mcp.server vs https://my.oauth.server
- Configure the MCP server so that https://my.mcp.server/.well-known/openid-configuration returns an HTTP 301 redirect to https://my.oauth.server/.well-known/openid-configuration
- Configure the OAuth server so that https://my.oauth.server/.well-known/openid-configuration specifies https://my.oauth.server as the issuer
- In
copilot-cli, type/mcp add FooBar, select type HTTP, remote server URL https://my.mcp.server, and the client ID when asked
Expected behavior
Copilot should ask to authenticate, then open the authentication URL in my browser (or display the authentication code and URL so that I can copy-paste them in my browser), then complete the authentication flow.
Additional context
This may be related to #4480 except that in #4480, the Atlassian MCP server gave the wrong issuer, whereas here the issuer is correct for the real URL and copilot-cli is checking against the wrong URL.
- 主要语言
- Shell
- 星标
- 11.2k
- 派生
- 1.9k
- 平均合并
- 14 小时 16 分钟
- 30 天内合并 PR
- 6
贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/copilot-cli 的其他 Issue
-
triage
难度 2/5 1-3 小时 新手友好度 75/100
github/copilot-cli#4932 ·
-
triage
难度 2/5 1-3 小时 新手友好度 78/100
github/copilot-cli#4909 ·
-
triage
难度 2/5 1-3 小时 新手友好度 76/100
github/copilot-cli#4906 ·
-
triage
难度 2/5 1-3 小时 新手友好度 72/100
github/copilot-cli#4848 ·
-
area:agents area:mcp
难度 2/5 1-3 小时 新手友好度 72/100
github/copilot-cli#4729 ·
查看 github/copilot-cli 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 75/100
elastic/gradle-plugins#156 ·
-
Priority/High ready-for-agent Severity/Major Type/Bug
难度 2/5 1-3 小时 新手友好度 75/100
-
comp/cli P3 type/docs
难度 2/5 1-3 小时 新手友好度 75/100
NousResearch/hermes-agent#119756 · 1 条评论 ·
-
comp: build/pipeline type: bug version: current (v17+)
难度 2/5 1-3 小时 新手友好度 74/100
angular/angularfire#3766 ·
-
out-of-date
难度 2/5 1-3 小时 新手友好度 70/100
CachyOS/CachyOS-PKGBUILDS#1903 ·