From 67def732ff49141be686fea4e8969334e317c76e Mon Sep 17 00:00:00 2001 From: Basil Hosmer Date: Thu, 25 Sep 2025 13:30:55 -0400 Subject: [PATCH] Fix token audience validation in separate auth mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The auth server's /introspect endpoint now correctly sets the 'aud' field to the resource server URL (BASE_URI) instead of the client ID. This ensures proper audience validation when the MCP server verifies tokens in separate mode. - Import BASE_URI in auth server - Set aud to BASE_URI in introspection response - Fixes "Token was not issued for this resource server" error 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude --- auth-server/index.ts | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/auth-server/index.ts b/auth-server/index.ts index e32debe..8db58a0 100644 --- a/auth-server/index.ts +++ b/auth-server/index.ts @@ -6,7 +6,7 @@ import { EverythingAuthProvider } from '../src/auth/provider.js'; import { handleFakeAuthorize, handleFakeAuthorizeRedirect } from '../src/handlers/fakeauth.js'; import { redisClient } from '../src/redis.js'; import { logger } from '../src/utils/logger.js'; -import { AUTH_SERVER_PORT, AUTH_SERVER_URL } from '../src/config.js'; +import { AUTH_SERVER_PORT, AUTH_SERVER_URL, BASE_URI } from '../src/config.js'; const app = express(); @@ -101,7 +101,7 @@ app.post('/introspect', introspectRateLimit, express.urlencoded({ extended: fals userId: authInfo.extra?.userId, // Custom field for our implementation username: authInfo.extra?.username, iss: AUTH_SERVER_URL, - aud: authInfo.clientId, + aud: BASE_URI, // The resource server URL this token is intended for token_type: 'Bearer' }); diff --git a/package.json b/package.json index 6ce81f3..2820ca8 100644 --- a/package.json +++ b/package.json @@ -15,7 +15,7 @@ "dev:with-separate-auth": "concurrently -n \"AUTH,MCP\" -c \"yellow,cyan\" \"npm run dev:auth-server\" \"npm run dev:separate\"", "build": "tsc && npm run copy-static", "copy-static": "mkdir -p dist/src/static && cp -r src/static/* dist/src/static/", - "lint": "eslint src/ auth-server/", + "lint": "eslint src/ auth-server/ shared/", "test": "NODE_OPTIONS=--experimental-vm-modules jest", "test:integrated": "AUTH_MODE=integrated npm test", "test:separate": "AUTH_MODE=separate npm test",