Skip to content

fix: Add redirect_uri parameter to /token endpoint for the Authorization Code Flow #354

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from

Conversation

dmystk
Copy link

@dmystk dmystk commented Apr 17, 2025

Add redirect_uri parameter to /token endpoint for the Authentication Code Flow.

Motivation and Context

The redirect_uri parameter is required for the Authorization Code Flow defined in RFC 6749.
But the current MCP SDK doesn't accept this parameter and just ignore it.

How Has This Been Tested?

npm test. And I also tested by the below server implementation:

import express, { Request, Response } from "express"
import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js"
import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js"
import { mcpAuthRouter } from '@modelcontextprotocol/sdk/server/auth/router.js'
import { ProxyOAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js'
import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js"

const BASE_URL = "http://localhost:3001"
const ISSUER = "https://your-tenant.auth0.com/"

const server = new McpServer({
  name: "mcp-server",
  version: "1.0.0",
})

server.resource(
  "greeting",
  new ResourceTemplate("greeting://{name}", { list: undefined }),
  async (uri, { name }) => ({
    contents: [{
      uri: uri.href,
      text: `Hello, ${name}!`
    }]
  })
);

const app = express();

const proxyProvider = new ProxyOAuthServerProvider({
  endpoints: {
    authorizationUrl: new URL("/authorize", ISSUER).toString(),
    tokenUrl: new URL("/oauth/token", ISSUER).toString(),
    registrationUrl: new URL("/oidc/register", ISSUER).toString(),
  },
  verifyAccessToken: async (token) => {
    console.log(token)  // for test
    return {
      token,
      clientId: "dummy",
      scopes: [],
    }
  },
  getClient: async (client_id) => {
    return {
      client_id,
      redirect_uris: ["http://127.0.0.1:6274/oauth/callback"],
    }
  }
})

app.use(mcpAuthRouter({
  provider: proxyProvider,
  issuerUrl: new URL(ISSUER),
  baseUrl: new URL(BASE_URL),
}))


const transports: { [sessionId: string]: SSEServerTransport } = {};

app.get("/sse", requireBearerAuth({provider: proxyProvider}), async (_: Request, res: Response) => {
  const transport = new SSEServerTransport('/messages', res);
  transports[transport.sessionId] = transport;
  res.on("close", () => {
    delete transports[transport.sessionId];
  });
  await server.connect(transport);
});

app.post("/messages", requireBearerAuth({provider: proxyProvider}), async (req: Request, res: Response) => {
  const sessionId = req.query.sessionId as string;
  const transport = transports[sessionId];
  if (transport) {
    await transport.handlePostMessage(req, res);
  } else {
    res.status(400).send('No transport found for sessionId');
  }
});

app.listen(3001)

I verified that my Auth0 tenant returns an access token when accessed with MCP Inspector.

Breaking Changes

The /token endpoint now requires a redirect_uri, however this is in accordance with the OAuth specification.

I also add redirector argument toexchangeAuthorizationCode of the OAuthServerProvider.
This might require some fix if developer uses OAuthServerProvider class.
(But I think it is few usage since currently this functionality missing required parameter)

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

@fredericbarthelet
Copy link
Contributor

I believe this is not required in OAuth 2.1 specs on server side (see conversation in corresponding PR adding support for redirect_uri in token call in client side) : #222

@dmystk
Copy link
Author

dmystk commented Apr 17, 2025

Thanks. It seems that I was mistaken, so I will cancel this pull request.

@dmystk dmystk closed this Apr 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants