Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

OAuth token exchange fails with URL-encoded responses - assumes JSON format only

未关闭 适合新手
  • 哪里不对？
#759 4 条评论 2 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
74/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
冷清
技术栈
typescript
领域
api, authentication

调研方向

从 client/auth.js 中的 exchangeAuthorization() 开始，issue 在这里指出了直接调用 response.json() 的问题。如果凭据可用，请针对 GitHub 的令牌端点复现此次交换，然后验证对 JSON 响应和 URL 编码响应的处理。只要 OAuthTokensSchema.parse 对任一格式都能成功，且不破坏现有的 HTTP 错误处理，就算完成。

由索引模型根据 Issue 内容生成。

描述

auth bug fix proposed P2 ready for work

** Describe the bug **
The exchangeAuthorization() function in client/auth.js assumes OAuth token responses are always in JSON format and calls response.json() directly. However, many OAuth providers (including GitHub) return token responses in URL-encoded format (application/x-www-form-urlencoded), causing token exchange to fail with a JSON parsing error.

** Steps to reproduce the behavior: **
Set up OAuth authentication with GitHub's MCP server (https://api.githubcopilot.com/mcp)
Register a GitHub OAuth app and configure pre-registered credentials
Complete the authorization flow successfully (Step 1 works fine)
Attempt token exchange in Step 2 of the OAuth flow
Observe JSON parsing error when GitHub returns URL-encoded token response

** Expected behavior **
The SDK should handle both common OAuth token response formats:
JSON format: {"access_token": "...", "token_type": "bearer", "scope": "..."}
URL-encoded format: access_token=...&token_type=bearer&scope=...
The token exchange should succeed regardless of which format the OAuth provider uses.

Logs

🔍 Token URL: https://github.com/login/oauth/access_token
🔍 Response Text: access_token=gho_oB*****************************&scope=gist%2Cnotifications%2Cpublic_repo&token_type=bearer

❌ SyntaxError: Unexpected token 'a', "access_tok"... is not valid JSON
    at JSON.parse (<anonymous>)
    at exchangeAuthorization (file://client/auth.js:335:41)

** Additional context **
OAuth Standards: Both response formats are valid according to OAuth 2.0/2.1 specifications. Different providers use different formats.
GitHub Behavior: GitHub's OAuth token endpoint returns URL-encoded responses by default, but does provide valid JSON when the new Accept request header is added. Not all oAuth servers will respect the Accept header though.

Current SDK Code (line ~325 in client/auth.js):

const response = await fetch(tokenUrl, {
       method: "POST",
       headers: {
           "Content-Type": "application/x-www-form-urlencoded",
       },
       body: params,
   });
   if (!response.ok) {
       throw new Error(`Token exchange failed: HTTP ${response.status}`);
   }
   return OAuthTokensSchema.parse(await response.json()); // ❌ Assumes JSON

** Suggested Fix **

const response = await fetch(tokenUrl, {
       method: "POST",
       headers: {
           "Content-Type": "application/x-www-form-urlencoded",
           "Accept": "application/json", // ✅ Request JSON response
       },
       body: params,
   });
   if (!response.ok) {
       throw new Error(`Token exchange failed: HTTP ${response.status}`);
   }
   
   // ✅ Handle both JSON and URL-encoded responses
   const responseText = await response.text();
   let tokenData;
   try {
       tokenData = JSON.parse(responseText);
   } catch (jsonError) {
       // Fallback to URL-encoded parsing
       const urlParams = new URLSearchParams(responseText);
       tokenData = {
           access_token: urlParams.get("access_token"),
           token_type: urlParams.get("token_type"),
           scope: urlParams.get("scope"),
           refresh_token: urlParams.get("refresh_token"),
           expires_in: urlParams.get("expires_in") ? parseInt(urlParams.get("expires_in")) : undefined,
       };
   }
   
   return OAuthTokensSchema.parse(tokenData);

This issue can be reproduced using GitHub's MCP server at https://api.githubcopilot.com/mcp with proper GitHub OAuth app credentials. NOTE: There is a related issue with GitHubs oAuth where by it does not expose it's oAuth info on .well-known/oauth-authorization-server, but rather returns a resource_metadata="https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp" param in the www-authenticate field (see #758)

** Impact **
This affects compatibility with any OAuth provider that returns URL-encoded token responses, making the SDK incompatible with a significant portion of OAuth servers.

主要语言
TypeScript
星标
13.4k
派生
2.2k
平均合并
5 天 3 小时
30 天内合并 PR
4

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

modelcontextprotocol/typescript-sdk 的其他 Issue

查看 modelcontextprotocol/typescript-sdk 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。