v0.1.3

QAuth v0.1.3 is the third patch release of the 0.1 line. It carries one change from main and nothing else from it, and is cut from release/v0.1.0. It is still pre-1.0, and no release has had an external security audit yet; see SECURITY.md.

Added

• Redirect URI schemes without a period, when the operator lists them (#774). Since v0.1.0 a redirect URI has had to be https, loopback http or a reverse-domain private-use scheme (com.example.app:). That shut out native apps that call back on a bare scheme, such as the Cursor desktop app's cursor://anysphere.cursor-mcp/oauth/callback. REDIRECT_URI_CUSTOM_SCHEMES names the bare schemes a deployment accepts, such as cursor.
  • A listed scheme is accepted by dynamic client registration, POST /api/clients, CIMD documents, and the authorization-time gate in /oauth/authorize and the consent screen.
  • Matching stays exact.
  • PKCE, required for every client, protects the code at either kind of custom scheme (RFC 8252 §8.1).
  • The server refuses to start when an entry is not a scheme name, or names a scheme a browser or the operating system acts on itself (http, https, javascript, data, file, intent, mailto and the like). It refuses such schemes at authorization whatever the list holds.

Before you upgrade from v0.1.2

• Nothing breaks. With REDIRECT_URI_CUSTOM_SCHEMES unset, behaviour is unchanged.
• The bundled docker-compose.yml now passes REDIRECT_URI_CUSTOM_SCHEMES through from .env.
• No migrations.

Full Changelog: v0.1.2...v0.1.3