modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

auth: issuer mix-up mitigation (#859)

Browse source 
This PR functions as a Reference implementation of
[SEP-2468](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2468)
/ [RFC9207](https://datatracker.ietf.org/doc/rfc9207/).

This PR hardens the MCP OAuth Client functionality against Mix-Up
attacks:
>   Mix-up attacks aim to steal an authorization code or access token by
>   tricking the client into sending the authorization code or access
> token to the attacker instead of the honest authorization or resource
>   server

This PR hardens the client by adding support for a new `iss` parameter
in authorization responses:
- Authorization Servers broadcast support for the `iss` parameter via
the `authorization_response_iss_parameter_supported` metadata parameter
- If the parameter is supported, clients expect to receive the `iss`
parameter in the authorization response
- Clients compare the `iss` parameter in the authorization response to
the `Issuer` parameter in the authorization metadata. The two must match
exactly for the response to be processed.

Fixes #941
This commit is contained in:
Max Gerber 2026-05-27 02:39:08 -07:00 • committed by GitHub
commit 2d47cc9664
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 151 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
examples/server/rate-limiting/go.mod
View file

@ -1,6 +1,6 @@
module github.com/modelcontextprotocol/go-sdk/examples/rate-limiting
go 1.23.0
go 1.25.0
require (
github.com/modelcontextprotocol/go-sdk v0.3.0