-
Notifications
You must be signed in to change notification settings - Fork 139
[Client] Implement OAuth 2.0 Authorization Code flow with PKCE (RFC 6749 + RFC 7636) #319
Copy link
Copy link
Open
Labels
ClientIssues & PRs related to the Client componentIssues & PRs related to the Client componentP0Broken core functionality, security issues, critical missing featureBroken core functionality, security issues, critical missing featureauthIssues and PRs related to Authentication / OAuthIssues and PRs related to Authentication / OAuthenhancementRequest for a new feature that's not currently supportedRequest for a new feature that's not currently supportedimproves spec complianceImproves consistency with other SDKs such as TyepScriptImproves consistency with other SDKs such as TyepScript
Metadata
Metadata
Assignees
Labels
ClientIssues & PRs related to the Client componentIssues & PRs related to the Client componentP0Broken core functionality, security issues, critical missing featureBroken core functionality, security issues, critical missing featureauthIssues and PRs related to Authentication / OAuthIssues and PRs related to Authentication / OAuthenhancementRequest for a new feature that's not currently supportedRequest for a new feature that's not currently supportedimproves spec complianceImproves consistency with other SDKs such as TyepScriptImproves consistency with other SDKs such as TyepScript
Type
Fields
Give feedbackNo fields configured for issues without a type.
Context
Primary user-facing flow. Required for any interactive MCP client to obtain tokens after PRM/AS discovery.
Scope
Mcp\Client\Auth\Grant\AuthorizationCodeGrant:code_verifier+code_challenge(S256).client_id,redirect_uri,response_type=code,code_challenge,code_challenge_method,scope,state,resource(audience-binding RFC 8707).token_endpoint; persist viaTokenStorageInterface.stateround-trip; reject mismatched.Conformance scenarios unblocked
auth/basic-cimdand prerequisite for all scope/refresh/cross-app scenarios.Dependencies
Blocked by: #315, #316, #317, #318. Pairs with #319 (token endpoint auth methods).
Acceptance
auth/basic-cimdpasses.cc @soyuka