modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Allow HTTP issuer URLs when MCP_DEV_MODE is enabled (#1189)

Browse source 
Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Jerome 2025-11-28 15:53:03 +00:00 • committed by GitHub
commit 5e0302fa77
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/server/auth/router.ts
View file

@ -7,6 +7,14 @@ import { metadataHandler } from './handlers/metadata.js';
import { OAuthServerProvider } from './provider.js';
import { OAuthMetadata, OAuthProtectedResourceMetadata } from '../../shared/auth.js';
// Check for dev mode flag that allows HTTP issuer URLs (for development/testing only)
const allowInsecureIssuerUrl =
process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === 'true' || process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === '1';
if (allowInsecureIssuerUrl) {
// eslint-disable-next-line no-console
console.warn('MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL is enabled - HTTP issuer URLs are allowed. Do not use in production.');
}
export type AuthRouterOptions = {
/**
* A provider implementing the actual authorization logic for this router.
@ -55,7 +63,7 @@ export type AuthRouterOptions = {
const checkIssuerUrl = (issuer: URL): void => {
// Technically RFC 8414 does not permit a localhost HTTPS exemption, but this will be necessary for ease of testing
if (issuer.protocol !== 'https:' && issuer.hostname !== 'localhost' && issuer.hostname !== '127.0.0.1') {
if (issuer.protocol !== 'https:' && issuer.hostname !== 'localhost' && issuer.hostname !== '127.0.0.1' && !allowInsecureIssuerUrl) {
throw new Error('Issuer URL must be HTTPS');
}
if (issuer.hash) {