Add server-side proxy endpoints for OAuth discovery, client registration,
and token exchange to avoid CORS issues when using proxy connection mode.
Server proxy endpoints:
- GET /oauth/resource-metadata - proxies OAuth protected resource metadata
- GET /oauth/metadata - proxies OAuth authorization server metadata
- POST /oauth/register - proxies dynamic client registration
- POST /oauth/token - proxies token exchange
Client changes:
- Construct correct RFC 9728/8414 path-aware well-known URLs client-side
- Route all OAuth discovery through proxy when in proxy connection mode
- Eliminate direct browser fetches that fail with CORS in proxy mode
- Create shared validateRedirectUrl utility to centralize URL validation
- Only allow HTTP and HTTPS protocols in OAuth authorization URLs
- Fix three vulnerable redirect paths that bypassed validation:
- AuthDebugger.tsx: Direct window.location.href redirect
- OAuthFlowProgress.tsx: window.open() without validation
- OAuthFlowProgress.tsx: Direct anchor href attribute
- Add comprehensive test coverage for URL validation
- Update existing auth.ts to use shared validation utility
This prevents malicious MCP servers from injecting javascript: or data:
protocol URLs that would execute XSS attacks when users are redirected
to the authorization endpoint.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* wip auth debugger
* cleanup types and validation
* more cleanup
* draft test
* wip clean up some
* rm toasts
* consolidate state management
* prettier
* hoist state up to App
* working with quick and guided
* sort out displaying debugger
* prettier
* cleanup types
* fix tests
* cleanup comment
* prettier
* fixup types in tests
* prettier
* refactor debug to avoid toasting
* callback shuffling
* linting
* types
* rm toast in test
* bump typescript sdk version to 0.11.2 for scope parameter passing
* use proper scope handling
* test scope parameter passing
* move functions and s/sseUrl/serverUrl/
* extract status message into component
* refactor progress and steps into components
* fix test
* rename quick handler
* one less click
* last step complete
* add state machine
* test and types
