modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

Merge pull request #615 from KKonstantinov/bugfix/authorization-url-generate-state

Browse source 
OAuth Flow: generate random state parameter in oauth state machine
This commit is contained in:
Ola Hungerford 2025-07-31 18:45:05 -07:00 • committed by GitHub
commit 33dbf8399e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
client/src/lib/oauth-state-machine.ts
View file

@ -113,6 +113,13 @@ export const oauthTransitions: Record<OAuthStep, StateTransition> = {
scope = metadata.scopes_supported.join(" "); scope = metadata.scopes_supported.join(" ");
} }
// Generate a random state
const array = new Uint8Array(32);
crypto.getRandomValues(array);
const state = Array.from(array, (byte) =>
byte.toString(16).padStart(2, "0"),
).join("");
const { authorizationUrl, codeVerifier } = await startAuthorization( const { authorizationUrl, codeVerifier } = await startAuthorization(
context.serverUrl, context.serverUrl,
{ {
@ -120,6 +127,7 @@ export const oauthTransitions: Record<OAuthStep, StateTransition> = {
clientInformation, clientInformation,
redirectUrl: context.provider.redirectUrl, redirectUrl: context.provider.redirectUrl,
scope, scope,
state: state,
resource: context.state.resource ?? undefined, resource: context.state.resource ?? undefined,
}, },
); );