fix(auth): callback iss must equal metadata issuer (honor metadataIssuer override) - #361
Merged
pcarleton merged 1 commit intoJun 24, 2026
Merged
Conversation
Copy link
Copy Markdown
Collaborator
Sorry, something went wrong.
…uer override) #359 made the metadata `issuer` honor the metadataIssuer override so the 2025-03-26 backcompat scenario is RFC 8414 §3.3-compliant. The authorize callback's `iss` parameter was still derived as `getAuthBaseUrl()+routePrefix`, so when a scenario sets metadataIssuer (bare origin) but keeps a routePrefix, the callback `iss` mismatches the metadata `issuer` and an RFC 9207-conforming client correctly rejects it. Extract `resolveIssuer()` and use it for both the metadata `issuer` and the `'correct'`/`'normalized'` callback `iss` so they always match.
Copy link
Copy Markdown
npx https://pkg.pr.new/@modelcontextprotocol/conformance@361 commit: 8a6fcba |
Sorry, something went wrong.
pcarleton
approved these changes
Jun 24, 2026
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The mock AS's authorization-response iss and its published metadata issuer are the same identifier by definition (RFC 9207 §2: "the authorization server's issuer identifier ... MUST be identical to the value in the issuer field of the authorization server metadata"). RFC 9207 §2.4 then requires clients to compare the received iss against the metadata issuer via simple string comparison and reject on any difference.
createAuthServer derived these two values independently:
So a scenario that sets metadataIssuer (to satisfy RFC 8414 §3.3) while keeping a routePrefix — exactly what auth/2025-03-26-oauth-metadata-backcompat does after #359 — produces a mock whose callback iss doesn't match its own metadata. An RFC 9207-conforming client correctly rejects it, and the scenario becomes un-passable for the wrong reason.
This extracts a single resolveIssuer() and uses it for both the metadata issuer and the 'correct'/'normalized' callback iss, so they're identical by construction. Scenarios that want a deliberate mismatch already use issInRedirect: 'wrong', which is unchanged.
Motivation and Context
Follow-up to #359. Surfaced by typescript-sdk#2344 turning RFC 9207 validation default-on: IssuerMismatchError: expected "http://localhost:45193", received "http://localhost:45193/oauth".
How Has This Been Tested?
Ran auth/2025-03-26-oauth-metadata-backcompat against typescript-sdk at the SEP-2468 head; passes with this change (fails without). Existing iss-* scenarios unaffected (they don't set metadataIssuer, so resolveIssuer() falls through to the original derivation).
Breaking Changes
None — resolveIssuer() returns exactly what each call site computed before when metadataIssuer is unset.
Types of changes
Checklist
Additional context
Once this lands in a published release, typescript-sdk can drop the auth/2025-03-26-oauth-metadata-backcompat expected-failure entry.