Allow any port for loopback redirect URIs (RFC 8252 §7.3)#3
Merged
Conversation
Port of modelcontextprotocol/typescript-sdk#1738: redirect_uri validation now ignores the port when both the requested and registered URIs target the same loopback host (localhost, 127.0.0.1, [::1]), so native clients that bind an ephemeral OS-assigned port can authorize. Scheme, hostname, path, and query must still match exactly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ports modelcontextprotocol/typescript-sdk#1738 (shipped upstream in v1.29.0), which this package predates since the auth server code was forked at ~1.24.0.
Per RFC 8252 §7.3 (OAuth 2.0 for Native Apps), authorization servers MUST allow any port for loopback redirect URIs, because native clients bind an ephemeral OS-assigned port at runtime. Previously
redirect_urivalidation required an exact string match against the registered URIs, so such clients were rejected withUnregistered redirect_uri.Changes
redirectUriMatches(requested, registered)helper (exported, mirroring upstream): ignores the port when both URIs target the same loopback host (localhost,127.0.0.1,[::1]). Scheme, hostname, path, and query must still match exactly — nolocalhost↔127.0.0.1cross-matching, per the RFC.authorizationHandler,authenticateHandler, andOAuthServer.authenticate().redirect_uricomparison intentionally remains an exact match (it must equal the value used in the authorization request).Tests
redirect-uri.test.tsunit suite covering port relaxation, hostname/scheme/path/query strictness, and unparseable URIs.