Merge pull request #715 from modelcontextprotocol/fweinberger/fix-sensitive-local-storage

fweinberger/fix sensitive local storage
2025-08-14 13:23:44 -04:00 · 2025-08-14 13:23:44 -04:00 · c5047ca30a
commit c5047ca30a
parent 16edf53794 36b9acc97e
1 changed files with 8 additions and 1 deletions
--- a/client/src/lib/auth.ts
+++ b/client/src/lib/auth.ts
@ -110,10 +110,17 @@ export class InspectorOAuthClientProvider implements OAuthClientProvider {
  }

  saveClientInformation(clientInformation: OAuthClientInformation) {
+    // Remove client_secret before storing (not needed after initial OAuth flow)
+    const safeInfo = Object.fromEntries(
+      Object.entries(clientInformation).filter(
+        ([key]) => key !== "client_secret",
+      ),
+    ) as OAuthClientInformation;
+
    // Save the dynamically registered client information to session storage
    saveClientInformationToSessionStorage({
      serverUrl: this.serverUrl,
-      clientInformation,
+      clientInformation: safeInfo,
      isPreregistered: false,
    });
  }