最新版本连接oauth的mcp服务，无法正常携带走完oauth流程获取到的token

[yidaixiaohui]

最新0.16.8版本连接oauth的mcp服务，无法正常携带走完oauth流程获取到的token
0.16.7版本测试是正常的，主要区别是提交了请求头设置这块的功能导致的

上面0.16.7版本不设置，默认会携带Authorization:Bearer Token，而在0.16.8版本设置默认不携带、设置携带Authorization:Bearer Token、Authorization:Token都无法携带token

[cngarrison]

Claude was helping me debug the problem...

---

Bingo! Found the bug! 🎯

The latest MCP Inspector is sending a malformed Authorization header:

authHeaderValue: '"Bearer"',
authHeaderLength: 6,

Inspector is sending JUST the word "Bearer" without:

❌ No space after "Bearer"
❌ No actual access token
❌ Total length is only 6 characters ("Bearer")

This is a bug in the latest MCP Inspector version!

---

Reverting to 0.16.7 resolves the issue.

[midthun]

in v0.16.8, I had to write "Bearer <token>" in the in put field, then it worked.

[yidaixiaohui]

上面可能我的表述有些误导，我是使用最新0.16.8版本连接oauth的mcp服务，想获取走完oauth流程得到的token设置在请求头中，但是目前都无法正常自动携带该token，手动设置token我这边还没试过

[cngarrison]

上面可能我的表述有些误导，我是使用最新0.16.8版本连接oauth的mcp服务，想获取走完oauth流程得到的token设置在请求头中，但是目前都无法正常自动携带该token，手动设置token我这边还没试过

I am using the latest 0.16.8 version to connect to the MCP service of OAuth, and I want to get the token obtained by the OAuth process and set it in the request header, but at present, I can't automatically carry the token normally, and I haven't tried to set the token manually

I didn't try to work out how to set the token manually - there appears to be a regression with 0.16.8 - the oAuth flow is broken.

[Xueyao-Huang]

@yidaixiaohui 老哥你在走oauth流程的时候，没有遇到CORS error吗，我在第一步遇到这个error：
Access to fetch at 'https://<redacted>/.well-known/oauth-protected-resource' from origin 'http://localhost:6274' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
具体描述跟这个issue一样，#817
请问你是怎么解决的

[olaservo]

Sorry going backwards through these - may be the same as: #826

[yidaixiaohui]

@Xueyao-Huang 第一步就遇到遇到CORS了，修改响应CORS配置就行，我是直接在网关层面加的Access-Control-Allow-Origin

[cliffhall]

Hi @yidaixiaohui!

Please try 0.17.0, changes have been made with regard to the Authorization token. And make sure you clear local and session storage in your browser's devtools first.

Currently working for me:

[yidaixiaohui]

@cliffhall 感谢解答，使用最新版本v0.17.0已解决该问题

[olaservo]

Thanks for the answer, the problem has been solved by using the latest version v0.17.0

(Translation of comment above)

Closing as fixed.