modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: ensure DCR always registers both redirect URIs

Browse source 
The `redirect_uris` getter used `this.redirectUrl`, which is overridden
by `DebugInspectorOAuthClientProvider` to return `/oauth/callback/debug`.
This caused the `Set` deduplication to collapse both URIs into one,
so DCR only registered `/oauth/callback/debug`. The normal connection
flow then sent `/oauth/callback` in the authorize request, which was
never registered — causing spec-compliant OAuth servers to reject it.

Use the base callback URLs directly instead of the polymorphic getter
so both URIs are always registered regardless of which subclass
initiates DCR.

Fixes #930
This commit is contained in:
Ahmet Soormally 2026-04-02 15:42:20 +01:00
commit abe1cf9b4f
1 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
client/src/lib/auth.ts
View file

@ -146,10 +146,15 @@ export class InspectorOAuthClientProvider implements OAuthClientProvider {
}
get redirect_uris() {
// Normally register both redirect URIs to support both normal and debug flows
// In debug subclass, redirectUrl may be the same as debugRedirectUrl, so remove duplicates
// Always register both redirect URIs to support both normal and debug flows.
// Use the base URLs directly (not this.redirectUrl) to avoid the debug subclass
// override collapsing both URIs into one, which causes the normal flow's
// /authorize request to use an unregistered redirect_uri.
// See: https://github.com/modelcontextprotocol/inspector/issues/825
return [...new Set([this.redirectUrl, this.debugRedirectUrl])];
// See: https://github.com/modelcontextprotocol/inspector/issues/930
const callbackUrl = window.location.origin + "/oauth/callback";
const debugCallbackUrl = window.location.origin + "/oauth/callback/debug";
return [callbackUrl, debugCallbackUrl];
}
get clientMetadata(): OAuthClientMetadata {