Skip to content

Pin allow-listed redirects to each vendor's callback path (CWE-601 hardening) #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aterga merged 6 commits into from
Jul 22, 2026
Merged

Pin allow-listed redirects to each vendor's callback path (CWE-601 hardening) #73

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a04ff99
Pin allow-listed redirects to each vendor's callback path (CWE-601)
claude Jul 22, 2026
29a453f
Address review: cache allow-list (OnceLock); reject dot-segment paths
claude Jul 22, 2026
56925d9
Address review: reject off-origin ports on hosted redirects and in en…
claude Jul 22, 2026
fbcea4c
Address review: clarify that default :443 is accepted in redirect-pre…
claude Jul 22, 2026
ea9a97f
Docs: call `https://host/path` a URL prefix, not an origin, in the se…
claude Jul 22, 2026
1fb58f2
monitoring: update stale env-var name to OAUTH_ALLOWED_REDIRECT_PREFIXES
claude Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 12 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -421,11 +421,18 @@ the callback page.
> Completion alone, since the victim's browser legitimately holds both proofs. It
> **is** closed by a **hosted-redirect allow-list**: dynamic client registration
> accepts only a loopback redirect, or a hosted redirect whose host is (a subdomain
> of) an allow-listed registrable domain, so an attacker cannot register a hosted
> destination it controls. The list is seeded with the known MCP connector vendors
> and widened per deployment with `OAUTH_ALLOWED_REDIRECT_DOMAINS` (additive);
> loopback/native clients are exempt (the code resolves on the consenter's own
> machine). Enforced at both `/oauth/register` and `/oauth/authorize`. A client
> of) an allow-listed registrable domain **and** whose path falls within that
> vendor's pinned OAuth-callback prefix, so an attacker cannot register a hosted
> destination it controls. The path pin matters because several allow-listed
> origins also serve third-party, script-capable content on the same origin
> (`perplexity.ai/page/…`, `chatgpt.com/g/…`, `/share/…`); a domain-only rule would
> let an attacker register such a path and capture the code from on-origin JS.
> Pinning to the vendor's dedicated callback path keeps every registration on a
> vendor-controlled, non-user-content endpoint. The list is seeded with the known
> MCP connector vendors' callback paths and widened per deployment with
> `OAUTH_ALLOWED_REDIRECT_PREFIXES` (additive; each entry a full `https://host/path`
> URL prefix, a bare domain is refused); loopback/native clients are exempt (the code
> resolves on the consenter's own machine). Enforced at both `/oauth/register` and `/oauth/authorize`. A client
Comment thread
Copilot marked this conversation as resolved.
Resolved
Comment thread
aterga marked this conversation as resolved.
Resolved
> turned away is pointed at a contact address to request approval:
> `/oauth/register` says so in its JSON `error_description`, and a browser that
> reaches `/oauth/authorize` gets an on-brand "not allowed" page (not a raw error)
Expand Down
2 changes: 1 addition & 1 deletion monitoring/mcp-status/checks.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -429,7 +429,7 @@ export const checkMcpEndpoints = async (mcpOrigin, timeoutMs) => {
// before any client_id is issued; loopback (above) stays exempt. The probe
// uses a reserved `.invalid` host (RFC 2606) that can never be legitimately
// allow-listed by a deployment, so this can't false-alert if the allow-list
// is widened via OAUTH_ALLOWED_REDIRECT_DOMAINS.
// is widened via OAUTH_ALLOWED_REDIRECT_PREFIXES.
{
const url = `${mcpOrigin}/oauth/register`;
const r = await probe(url, {
Expand Down
Loading