modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Default to client_secret_basic when server omits token_endpoint_auth_methods_supported (#1594)

Browse source 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
This commit is contained in:
bhosmer-ant 2026-03-02 06:31:29 -05:00 • committed by GitHub
commit 9a8f37b366
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 80 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

18
packages/client/src/client/auth.ts
View file

@ -257,21 +257,25 @@ const AUTHORIZATION_CODE_CHALLENGE_METHOD = 'S256';
export function selectClientAuthMethod(clientInformation: OAuthClientInformationMixed, supportedMethods: string[]): ClientAuthMethod {
const hasClientSecret = clientInformation.client_secret !== undefined;
// If server doesn't specify supported methods, use RFC 6749 defaults
if (supportedMethods.length === 0) {
return hasClientSecret ? 'client_secret_post' : 'none';
}
// Prefer the method returned by the server during client registration if valid and supported
// Prefer the method returned by the server during client registration, if valid.
// When server metadata is present we also require the method to be listed as supported;
// when supportedMethods is empty (metadata omitted the field) the DCR hint stands alone.
if (
'token_endpoint_auth_method' in clientInformation &&
clientInformation.token_endpoint_auth_method &&
isClientAuthMethod(clientInformation.token_endpoint_auth_method) &&
supportedMethods.includes(clientInformation.token_endpoint_auth_method)
(supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method))
) {
return clientInformation.token_endpoint_auth_method;
}
// If server metadata omits token_endpoint_auth_methods_supported, RFC 8414 §2 says the
// default is client_secret_basic. RFC 6749 §2.3.1 also requires servers to support HTTP
// Basic authentication for clients with a secret, making it the safest default.
if (supportedMethods.length === 0) {
return hasClientSecret ? 'client_secret_basic' : 'none';
}
// Try methods in priority order (most secure first)
if (hasClientSecret && supportedMethods.includes('client_secret_basic')) {
return 'client_secret_basic';