2d47cc9664This PR functions as a Reference implementation of [SEP-2468](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2468) / [RFC9207](https://datatracker.ietf.org/doc/rfc9207/). This PR hardens the MCP OAuth Client functionality against Mix-Up attacks: > Mix-up attacks aim to steal an authorization code or access token by > tricking the client into sending the authorization code or access > token to the attacker instead of the honest authorization or resource > server This PR hardens the client by adding support for a new `iss` parameter in authorization responses: - Authorization Servers broadcast support for the `iss` parameter via the `authorization_response_iss_parameter_supported` metadata parameter - If the parameter is supported, clients expect to receive the `iss` parameter in the authorization response - Clients compare the `iss` parameter in the authorization response to the `Issuer` parameter in the authorization metadata. The two must match exactly for the response to be processed. Fixes #941
15 lines
348 B
Modula-2
15 lines
348 B
Modula-2
module github.com/modelcontextprotocol/go-sdk/examples/rate-limiting
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/modelcontextprotocol/go-sdk v0.3.0
|
|
golang.org/x/time v0.12.0
|
|
)
|
|
|
|
require (
|
|
github.com/google/jsonschema-go v0.4.2 // indirect
|
|
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
|
|
)
|
|
|
|
replace github.com/modelcontextprotocol/go-sdk => ../../../
|