From 024ca090687571064286100ac3b07343aedd89f5 Mon Sep 17 00:00:00 2001 From: flipslidersand Date: Tue, 8 Sep 2026 00:44:50 +0900 Subject: [PATCH] docs(client): correct SEP attribution on insecure-token-endpoint check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit InsecureTokenEndpointError and assertSecureTokenEndpoint attributed the non-TLS token endpoint check to SEP-2207. SEP-2207 ("OIDC-Flavored Refresh Token Guidance") specifies offline_access scope handling and says nothing about TLS requirements. The actual normative source for the HTTPS requirement is the MCP authorization spec, which incorporates OAuth 2.1 §1.5 ("All the OAuth protocol URLs … MUST use the https scheme except for loopback interface redirect URIs"). Replace the incorrect SEP-2207 citation with "MCP authorization spec, OAuth 2.1 §1.5" in both affected doc comments. The behaviour is unchanged; only the attribution is corrected. Fixes #2766 Co-Authored-By: Claude Sonnet 4.6 --- packages/client/src/client/auth.ts | 3 ++- packages/client/src/client/authErrors.ts | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/packages/client/src/client/auth.ts b/packages/client/src/client/auth.ts index 4c37339297..b9b989409c 100644 --- a/packages/client/src/client/auth.ts +++ b/packages/client/src/client/auth.ts @@ -866,7 +866,8 @@ function isLoopbackHost(hostname: string): boolean { } /** - * SEP-2207: refuse to send credentials to a non-TLS, non-loopback token endpoint. + * Refuses to send credentials to a non-TLS, non-loopback token endpoint + * (MCP authorization spec, OAuth 2.1 §1.5). * Throws {@linkcode InsecureTokenEndpointError}. Loopback hosts are exempt. */ export function assertSecureTokenEndpoint(tokenEndpoint: string | URL): URL { diff --git a/packages/client/src/client/authErrors.ts b/packages/client/src/client/authErrors.ts index e8925b2f86..5912c47536 100644 --- a/packages/client/src/client/authErrors.ts +++ b/packages/client/src/client/authErrors.ts @@ -132,7 +132,8 @@ export class RegistrationRejectedError extends OAuthClientFlowError { /** * Thrown by the token-exchange and refresh paths when the resolved token - * endpoint is not `https:` and is not a loopback host (SEP-2207). This is a + * endpoint is not `https:` and is not a loopback host (MCP authorization spec, + * OAuth 2.1 §1.5). This is a * configuration error — re-authorizing cannot fix it — so it intentionally does * **not** extend `OAuthError` and `auth()`'s refresh branch rethrows it instead * of falling through to a fresh `/authorize` redirect.