modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(server/auth): RFC 8252 loopback port relaxation (#1738)

Browse source
This commit is contained in:
Alice T'Poteat 2026-03-25 03:47:45 -07:00 • committed by GitHub
commit 897bc25bfe
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 148 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
.changeset/rfc8252-loopback-port-relaxation.md Normal file
View file

@ -0,0 +1,6 @@
---
'@modelcontextprotocol/sdk': patch
---
The authorization handler now applies RFC 8252 §7.3 loopback port relaxation when validating `redirect_uri` against a client's registered URIs. For `localhost`, `127.0.0.1`, and `[::1]` hosts, any port is accepted as long as scheme, host, path, and query match. This fixes native
clients that obtain an ephemeral port from the OS but register a portless loopback URI (e.g., via CIMD / SEP-991).