Align MCP server with the 2026-07-28 specification - #2454
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6be7f66af1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| AuthorizationRoles.StacksWrite, | ||
| AuthorizationRoles.EventsRead, | ||
| AuthorizationRoles.OfflineAccess | ||
| AuthorizationRoles.EventsRead |
There was a problem hiding this comment.
BLOCKER: Existing clients that construct authorization requests from the MCP protected-resource metadata will stop requesting offline_access after it disappears from scopes_supported; their newly issued tokens then lack refresh tokens and require reauthorization after the access token expires. This changes a published API response, so preserve the scope or obtain explicit approval and provide a compatible migration path.
AGENTS.md reference: AGENTS.md:L67-L67
Useful? React with 👍 / 👎.
| return null; | ||
|
|
||
| TimeSpan responseAge = response.Headers.Age ?? TimeSpan.Zero; | ||
| TimeSpan? cacheLifetime = cacheControl?.MaxAge - responseAge; |
There was a problem hiding this comment.
When a metadata server returns a shared-cache directive such as Cache-Control: s-maxage=0, max-age=3600, this ICacheClient cache uses max-age and retains the document for an hour even though s-maxage forbids shared reuse; if only s-maxage is present, it instead falls back to the configured lifetime. Because production can back this cache with Redis, stale redirect URIs and scopes can be reused across requests and instances beyond the client's requested freshness window; prefer SharedMaxAge when it is present.
Useful? React with 👍 / 👎.
|
niemyjski
left a comment
niemyjski
left a comment
There was a problem hiding this comment.
Looks good, just missing act assert arrange on tests for consistency.
2 participants
Summary
Originheader site-wide against the configured public originWhy
This aligns the MCP and OAuth implementation with the 2026-07-28 specification while preserving down-level protocol support and the MCP server work in #2430.
This PR is intentionally stacked on #2430 and should merge after it.
Impact
Invalid browser origins are rejected with HTTP 403 across the site, while requests without an
Originheader and requests from the configured public origin continue normally. OAuth clients receive the required resource scope and issuer metadata. No public API or configuration keys are removed.Verification
npm run check: 0 errors, 0 warningsgit diff --check: passedBreaking changes
None.