modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Validate redirect URIs _as_ URIs

Browse source
This commit is contained in:
Justin Spahr-Summers 2025-02-17 14:46:08 +00:00
commit 54f643cee8
No known key found for this signature in database
2 changed files with 13 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/server/auth/handlers/authorize.ts
View file

@ -1,6 +1,7 @@
import { RequestHandler } from "express";
import { z } from "zod";
import { OAuthRegisteredClientsStore } from "../clients.js";
import { isValidUrl } from "../validation.js";
export type AuthorizationHandlerOptions = {
/**
@ -11,7 +12,7 @@ export type AuthorizationHandlerOptions = {
const ClientAuthorizationParamsSchema = z.object({
client_id: z.string(),
redirect_uri: z.string().optional(),
redirect_uri: z.string().optional().refine((value) => value === undefined || isValidUrl(value), { message: "redirect_uri must be a valid URL" }),
});
const RequestAuthorizationParamsSchema = z.object({
@ -45,7 +46,7 @@ export function authorizationHandler({ store }: AuthorizationHandlerOptions): Re
if (redirect_uri !== undefined) {
if (!client.redirect_uris.includes(redirect_uri)) {
res.status(400).end("Bad Request: invalid redirect_uri");
res.status(400).end("Bad Request: unregistered redirect_uri");
return;
}
} else if (client.redirect_uris.length === 1) {

8
src/server/auth/validation.ts Normal file
View file

@ -0,0 +1,8 @@
export function isValidUrl(s: string): boolean {
try {
new URL(s);
return true;
} catch (error) {
return false;
}
}