docs(client): correct SEP attribution on insecure-token-endpoint check - #2767
Conversation
InsecureTokenEndpointError and assertSecureTokenEndpoint attributed the
non-TLS token endpoint check to SEP-2207. SEP-2207 ("OIDC-Flavored
Refresh Token Guidance") specifies offline_access scope handling and says
nothing about TLS requirements.
The actual normative source for the HTTPS requirement is the MCP
authorization spec, which incorporates OAuth 2.1 §1.5 ("All the OAuth
protocol URLs … MUST use the https scheme except for loopback interface
redirect URIs").
Replace the incorrect SEP-2207 citation with "MCP authorization spec,
OAuth 2.1 §1.5" in both affected doc comments. The behaviour is
unchanged; only the attribution is corrected.
Fixes modelcontextprotocol#2766
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
@modelcontextprotocol/client
@modelcontextprotocol/codemod
@modelcontextprotocol/core
@modelcontextprotocol/server
@modelcontextprotocol/server-legacy
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 024ca09068
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| /** | ||
| * SEP-2207: refuse to send credentials to a non-TLS, non-loopback token endpoint. | ||
| * Refuses to send credentials to a non-TLS, non-loopback token endpoint | ||
| * (MCP authorization spec, OAuth 2.1 §1.5). |
There was a problem hiding this comment.
For a token endpoint such as http://127.0.0.1/token, this function permits the request, but OAuth 2.1 §1.5 limits its HTTP exception specifically to loopback-interface redirect URIs, not token endpoints. The new attribution therefore still presents the implemented loopback-token-endpoint exception as an OAuth 2.1 requirement; cite a normative source that actually permits this exception, or describe it as an SDK-specific policy.
Useful? React with 👍 / 👎.
1 participant
Summary
InsecureTokenEndpointErrorandassertSecureTokenEndpointboth cite SEP-2207 as the normative source for the non-TLS token endpoint requirement. SEP-2207 is "OIDC-Flavored Refresh Token Guidance" — it specifiesoffline_accessscope handling and says nothing about TLS at the token endpoint.The correct normative source is the MCP authorization spec, which incorporates OAuth 2.1 §1.5:
This PR replaces the incorrect
SEP-2207citation withMCP authorization spec, OAuth 2.1 §1.5in both affected doc comments. No behaviour changes.Files changed
packages/client/src/client/authErrors.ts—InsecureTokenEndpointErrordoc commentpackages/client/src/client/auth.ts—assertSecureTokenEndpointdoc commentNote: other
SEP-2207references inauth.ts(lines ~1093, ~1122, ~2507) are aboutoffline_accessscope handling and are correct — those are untouched.Fixes #2766
🤖 Generated with Claude Code