modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
typescript-sdk/.changeset/auth-iss-validation.md
Felix Weinberger 1823aae891
 Implement MCP 2026-07-28 (#2286) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-06-26 14:01:10 +01:00

656 B
Raw Blame History

@modelcontextprotocol/core-internal @modelcontextprotocol/client
minor minor

Implement RFC 9207 / RFC 8414 §3.3 OAuth issuer validation (SEP-2468). discoverAuthorizationServerMetadata() now rejects metadata whose issuer does not match the discovery URL (opt out via skipIssuerValidation / AuthOptions.skipIssuerMetadataValidation — security-weakening). auth(), exchangeAuthorization(), fetchToken(), and transport.finishAuth(code, iss?) now validate the authorization-callback iss against the recorded issuer before redeeming the code; new IssuerMismatchError and validateAuthorizationResponseIssuer() are exported.