Skip to content

docs(client): correct token endpoint TLS citation #2768

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
web-abin wants to merge 1 commit into
base: main
Choose a base branch
from
+16 −6
Open

docs(client): correct token endpoint TLS citation #2768

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/correct-token-endpoint-tls-citation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@modelcontextprotocol/client': patch
---

Correct the JSDoc for insecure OAuth token endpoints. The TLS requirement comes from the MCP authorization specification's OAuth 2.1 communication-security rules, not SEP-2207, which covers OIDC-flavored refresh-token guidance. Documentation only; no runtime behavior change.
7 changes: 5 additions & 2 deletions packages/client/src/client/auth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -866,8 +866,11 @@ function isLoopbackHost(hostname: string): boolean {
}

/**
* SEP-2207: refuse to send credentials to a non-TLS, non-loopback token endpoint.
* Throws {@linkcode InsecureTokenEndpointError}. Loopback hosts are exempt.
* Refuse to send credentials to a non-TLS token endpoint. The MCP authorization
* specification requires authorization server endpoints to use HTTPS. Loopback
* hosts are exempt here for local development.
*
* @throws {@linkcode InsecureTokenEndpointError} if the endpoint is insecure.
*/
export function assertSecureTokenEndpoint(tokenEndpoint: string | URL): URL {
const url = new URL(String(tokenEndpoint));
Expand Down
10 changes: 6 additions & 4 deletions packages/client/src/client/authErrors.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,10 +132,12 @@ export class RegistrationRejectedError extends OAuthClientFlowError {

/**
* Thrown by the token-exchange and refresh paths when the resolved token
* endpoint is not `https:` and is not a loopback host (SEP-2207). This is a
* configuration error — re-authorizing cannot fix it — so it intentionally does
* **not** extend `OAuthError` and `auth()`'s refresh branch rethrows it instead
* of falling through to a fresh `/authorize` redirect.
* endpoint is not `https:` and is not a loopback host. The MCP authorization
* specification requires authorization server endpoints to use HTTPS; loopback
* hosts are exempt here for local development. This is a configuration error —
* re-authorizing cannot fix it — so it intentionally does **not** extend
* `OAuthError` and `auth()`'s refresh branch rethrows it instead of falling
* through to a fresh `/authorize` redirect.
*/
export class InsecureTokenEndpointError extends OAuthClientFlowError {
static {
Expand Down
Loading