fix(auth): enforce form-urlencoded Content-Type for token endpoint#1774
fix(auth): enforce form-urlencoded Content-Type for token endpoint#1774lanxevo3 wants to merge 2 commits intomodelcontextprotocol:mainfrom
Conversation
OAuth 2.1 §3.2 requires token endpoint requests to use application/x-www-form-urlencoded regardless of grant type. Add an explicit header.set() call immediately before the fetch in executeTokenRequest() to prevent any addClientAuthentication implementation from accidentally overriding the Content-Type. Fixes modelcontextprotocol/inspector#1160
|
@modelcontextprotocol/client
@modelcontextprotocol/server
@modelcontextprotocol/express
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
|
@claude review |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM, straightforward defensive fix re-enforcing the spec-mandated Content-Type.
Extended reasoning...
Overview
This PR adds a single defensive headers.set('Content-Type', 'application/x-www-form-urlencoded') call in executeTokenRequest() right before the fetch, ensuring that custom addClientAuthentication implementations cannot accidentally override the Content-Type. The header is already set when the Headers object is constructed, so this is a redundant safety net — it can only make things more correct, never less.
Security risks
None. The change strictly enforces the OAuth 2.1 §3.2 requirement for form-urlencoded Content-Type on token endpoint requests. It cannot weaken security — it only prevents a potential misconfiguration by custom auth implementations.
Level of scrutiny
Low scrutiny needed. This is a 1-line code change (plus 2 comment lines) that is idempotent with the existing header initialization. The blast radius is minimal — it only affects the case where a custom addClientAuthentication callback incorrectly overrides Content-Type, which would currently be a bug.
Other factors
- No bugs were found by the automated bug hunting system.
- The PR description mentions changes to
registerClient()but the diff only modifiesexecuteTokenRequest(). This is a minor description inaccuracy —registerClient()usesapplication/jsonper RFC 7591 and doesn't need this fix. - The changeset bot flagged a missing changeset, which is a process concern for the maintainers but doesn't affect correctness.
- No tests were added, but this specific defensive behavior would require mocking a misbehaving
addClientAuthenticationcallback, and the fix is straightforward enough to verify by inspection.
2 participants
Summary
OAuth 2.1 §3.2 requires token endpoint requests to use \�pplication/x-www-form-urlencoded\ regardless of grant type.
Adds an explicit \headers.set('Content-Type', 'application/x-www-form-urlencoded')\ call immediately before the \ etch\ in \executeTokenRequest()\ as a defensive measure — ensuring no \�ddClientAuthentication\ implementation can accidentally override the Content-Type.
Changes
\packages/client/src/client/auth.ts:
egisterClient(): re-enforce Content-Type before fetch
References