Skip to content

fix(mcp): gate every spelling of the OAuth endpoint #3187

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
L4XB wants to merge 1 commit into
base: master
Choose a base branch
from
+18 −1
Open

fix(mcp): gate every spelling of the OAuth endpoint #3187

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/oauth-route-spelling.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"@upstash/context7-mcp": patch
---

Apply the OAuth endpoint's authentication requirement to every spelling Express routes to it (`/mcp/oauth/`, `/MCP/OAUTH`), not only the exact `/mcp/oauth`.
5 changes: 4 additions & 1 deletion packages/mcp/src/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,10 @@ function getPluginFromRequest(req: express.Request): typeof CLAUDE_CODE_PLUGIN |

function requiresAuthentication(req: express.Request, plugin?: typeof CLAUDE_CODE_PLUGIN): boolean {
// The MCP routes live on a router mounted at /mcp, so req.path is relative to it.
const isOAuthEndpoint = `${req.baseUrl}${req.path}` === "/mcp/oauth";
// Express routes "/mcp/oauth/" and "/MCP/OAUTH" to the same handler but keeps the
// request's spelling here, so compare the canonical form (as mcpRouteFromUrl does).
const isOAuthEndpoint =
`${req.baseUrl}${req.path}`.replace(/\/+$/, "").toLowerCase() === "/mcp/oauth";
// The current official Claude plugin expands an unset API key to an empty header.
const hasEmptyPluginAuthorization =
plugin === CLAUDE_CODE_PLUGIN && req.headers.authorization === "";
Expand Down
9 changes: 9 additions & 0 deletions packages/mcp/test/integration.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -756,6 +756,15 @@ describe("plugin authentication", () => {
expect(emptyHeaderRes.status).toBe(401);
});

test("protects every spelling Express routes to the OAuth endpoint", async () => {
// Express matches routes case-insensitively and with an optional trailing
// slash; the gate must not depend on the request's spelling.
for (const spelling of ["/mcp/oauth/", "/MCP/OAUTH", "/Mcp/OAuth/"]) {
const url = httpUrl.replace(/\/mcp$/, spelling);
expect((await postMcp(url)).status, spelling).toBe(401);
}
});

test("tracks authenticated plugin requests separately", async () => {
const client = new Client(
{ name: "claude-code", version: "1.0.0" },
Expand Down