Skip to content

5.3.15

Choose a tag to compare

View all tags
@niranz-dev niranz-dev released this 20 Aug 20:42
· 13 commits to main since this release
v5.3.15
f25160e

A connector could not sign in, and the reason was a 404.

Both OAuth RFCs build the discovery URL by putting the well-known segment in
front of the resource's own path rather than at the site root, and every current
connector asks that way:

/.well-known/oauth-protected-resource/wp-json/mcp/niranzwp

Only the bare path was answered. So the whole browser grant was there — the
authorize endpoint, PKCE, the approval screen, the token exchange — and no
connector could reach any of it, because the first document it looks for was
missing.

Both forms are answered now. A suffix that is not this site's own MCP endpoint
still is not: claiming to be the authorization server for some other path would
be answering a question nobody asked.

The WWW-Authenticate header on the MCP endpoint points at the path-inserted
URL as well, which is the canonical one for this resource.

Assets 4
Loading