Repository navigation
fix(core): keep MCP OAuth login waiting after stray callback requests - #58342
Merged
Merged
Conversation
The loopback callback treated any request to its path as the OAuth redirect. A request without OAuth parameters, such as a browser preflight, prefetch, or reload, failed the login with "OAuth state mismatch", and the real redirect that followed got 409. Answer such requests with an error page but keep waiting. Redirects that carry an error, a wrong state, or no code still fail the login. Fixes #55201 Co-authored-by: Reynold Hu <88558425+reynold-hu@users.noreply.github.com>
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Looks good. I ran the #55201 reproduction (an OPTIONS preflight to the loopback callback, then the real redirect) from source on both checkouts. On the base the login ends with OAuth state mismatch (exit 1). With this change the preflight gets a 400, the real callback completes, and the CLI ends with Connected to mock (exit 0). The new test passes. Across test/mcp-oauth.test.ts and test/mcp.test.ts the only failure is a process-termination test that also fails on the base. tsc -b passes. Redirects that carry error, a wrong state, or a state without a code still fail the login.
Public API: unchanged.
No concerns.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #55201
Problem
During MCP OAuth login, opencode listens on a loopback callback for the authorization server's redirect. The handler treats every request to the callback path as that redirect. A request without OAuth parameters, such as a browser preflight, prefetch, or reload, fails the whole login with "OAuth state mismatch". The real redirect that arrives afterwards gets
409 OAuth callback already received, and no token exchange happens.Change
callback(request) if error param: fail login + if no state and no code: reply 400, keep waiting if state != expected: fail login if no code: fail login complete loginA request with no OAuth parameters at all gets the error page but no longer ends the login. Redirects that carry an
error, a wrongstate, or astatewithout acodestill fail it, as before.This is a trimmed version of #56812, which also answers CORS/Private Network Access preflights. Chrome no longer sends those for top-level navigations, so I kept only the part that stops a stray request from ending the login. @reynold-hu is credited as co-author.
A new test sends an
OPTIONSrequest and a bareGETto the callback before the real redirect. Without the fix the redirect gets409.