modelcontextprotocol/ruby-sdk
Watch
1
0
Fork
You've already forked ruby-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #431 from koic/iss_parameter_validation

Browse source 
Validate the RFC 9207 `iss` Authorization Response Parameter per SEP-2468
This commit is contained in:
Koichi ITO 2026-07-12 02:11:52 +09:00 • committed by GitHub
commit 8aae052efd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 163 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -2348,7 +2348,9 @@ Required keyword arguments to `Provider.new`:
an explicit value always wins.
- `redirect_uri`: String. Must use HTTPS or be a loopback URL (`localhost`, `127.0.0.0/8`, `::1`); other values raise `Provider::InsecureRedirectURIError`.
- `redirect_handler`: Callable invoked with the fully-built authorization `URI`. Typically opens the user's browser.
- `callback_handler`: Callable that returns `[code, state]` after the user is redirected back to `redirect_uri`.
- `callback_handler`: Callable that returns `[code, state]` or `[code, state, iss]` after the user is redirected back to `redirect_uri`. Returning the 3-element form
(with `iss` set to the RFC 9207 `iss` parameter from the redirect, or `nil` when absent) opts into SEP-2468 issuer validation: a present `iss` must match
the authorization server's issuer, and a missing one is rejected when the server advertises `authorization_response_iss_parameter_supported`.
Optional keyword arguments: