Follow-up from code review on the MCP server feature (#50).
Five small auth-flow hardening items. None block shipping; all are <1-day cleanups.
- Allow-list comparison is case-sensitive (
mcp/src/oauth/github.ts:112). A typo in ALLOWED_GH_USERS silently locks out the user. Lowercase both sides.
- OAuth
code and state query params leak into log files (mcp/src/server.ts:53-66). The request logger writes full query strings to $HOME/log/tasklog-mcp/current. Redact code, state, code_verifier, code_challenge (or log path-only).
- Auth code TTL is 10 minutes (
mcp/src/oauth/github.ts:27). OAuth 2.1 / RFC 6749 §4.1.2 recommends <=60s. Lower to 60-120s.
resource query param is accepted unvalidated (mcp/src/oauth/authorize.ts:89). A wrong value silently issues a token that fails bearer auth later. Validate it normalizes to config.publicUrl.- No log line at OAuth rejection decisions (
mcp/src/oauth/middleware.ts). You see 401 8ms without knowing whether the cause was audience, expiry, or token-not-found. One console.warn per rejection reason fixes this cheaply.
Source: review of feature/mcp-server-#50.
Follow-up from code review on the MCP server feature (#50).
Five small auth-flow hardening items. None block shipping; all are <1-day cleanups.
mcp/src/oauth/github.ts:112). A typo inALLOWED_GH_USERSsilently locks out the user. Lowercase both sides.codeandstatequery params leak into log files (mcp/src/server.ts:53-66). The request logger writes full query strings to$HOME/log/tasklog-mcp/current. Redactcode,state,code_verifier,code_challenge(or log path-only).mcp/src/oauth/github.ts:27). OAuth 2.1 / RFC 6749 §4.1.2 recommends <=60s. Lower to 60-120s.resourcequery param is accepted unvalidated (mcp/src/oauth/authorize.ts:89). A wrong value silently issues a token that fails bearer auth later. Validate it normalizes toconfig.publicUrl.mcp/src/oauth/middleware.ts). You see401 8mswithout knowing whether the cause was audience, expiry, or token-not-found. Oneconsole.warnper rejection reason fixes this cheaply.Source: review of feature/mcp-server-#50.