modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Forward RFC 9207 iss to the v2 SDK (fixes OAuth + EMA leg 1)

Browse source 
SDK v2 added RFC 9207 §2.4 authorization-response issuer validation
(`validateAuthorizationResponseIssuer` / `IssuerMismatchError`) as a mix-up
attack defense. It is strict: when AS metadata advertises
`authorization_response_iss_parameter_supported: true` and no `iss` reaches
`exchangeAuthorization`/`auth()`, the exchange throws.

v1.29.0 had no `iss` parameter and no RFC 9207 validation at all, so dropping
the callback `iss` was harmless. The migration swapped in the stricter SDK
without feeding it the new input, breaking the authorization-code exchange
against any RFC 9207 authorization server (Okta/xaa.dev advertise it):

    Issuer mismatch in authorization response (RFC 9207):
    expected "https://idp.xaa.dev", received undefined

Found by smoke-testing EMA against live xaa.dev staging; not caught by CI
because the mock IdP never advertised the parameter, so the SDK took its
lenient path (a missing `iss` is only fatal when advertised).

`iss` was dropped in three places, with the plumbing half-built —
`oauthManager`/`inspectorClient` already accepted `iss`, but nothing supplied
or forwarded it:

- `parseOAuthCallbackParams` never extracted `iss` from the callback query
- `mcpAuth` never forwarded `options.iss` to SDK `auth()` — its own comment
  ("forwarded on v2 upgrade; ignored by v1 SDK auth()") predicted this exact
  gap, so standard OAuth was broken identically, not just EMA
- EMA leg 1 (`completeIdpOidcAuthorization`) never passed `iss` to
  `exchangeAuthorization`

Thread `iss` end to end: callback query -> CallbackParams -> resumeAfterOAuth
-> completeOAuthFlow -> {mcpAuth | EMA leg 1} -> SDK. The Node callback server
and runner carry it for CLI/TUI.

Tests: `ema-mock-servers.ts` now advertises
`authorization_response_iss_parameter_supported: true` so the mock is at least
as strict as real IdPs — with it absent the SDK silently takes the lenient path
and a dropped `iss` goes unnoticed. Flipping it made three existing tests
reproduce the failure. Adds regression coverage for forwarding and for
rejecting a mismatched `iss` before any network call.

Verified end to end against live xaa.dev staging: EMA legs 1-3 (IdP SSO ->
ID-JAG mint -> resource token) now complete and the MCP session initializes.

web 3099, cli 212, tui 274 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VjMemXZohSR2EndBQYif2b
This commit is contained in:
cliffhall 2026-07-15 20:16:43 -04:00
commit f4fb4b50c9
1 changed files with 125 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

11
clients/web/src/test/integration/mcp/ema-mock-servers.ts
View file

@ -21,7 +21,15 @@ export const EMA_MOCK_IDP_CLIENT_SECRET = "ema-mock-idp-secret";
export const EMA_MOCK_RESOURCE_CLIENT_ID = "ema-mock-resource-client";
export const EMA_MOCK_RESOURCE_CLIENT_SECRET = "ema-mock-resource-secret";
/** Fields required by SDK `OAuthMetadataSchema` for discovery in tests. */
/**
* Fields required by SDK `OAuthMetadataSchema` for discovery in tests.
*
* `authorization_response_iss_parameter_supported` mirrors real-world IdPs
* (e.g. Okta/xaa.dev): once advertised, the SDK enforces RFC 9207 §2.4 and
* rejects a callback whose `iss` is missing. Keep it on so the mock stays at
* least as strict as production servers — with it absent the SDK silently takes
* its lenient path and a dropped `iss` goes unnoticed.
*/
export function minimalOAuthAsMetadata(
baseUrl: string,
authorizationEndpoint = `${baseUrl}/authorize`,
@ -32,6 +40,7 @@ export function minimalOAuthAsMetadata(
token_endpoint: `${baseUrl}/token`,
response_types_supported: ["code"],
token_endpoint_auth_methods_supported: ["client_secret_post"],
authorization_response_iss_parameter_supported: true,
};
}