fix(mcp): deduplicate auth refresh on http transport#15518
Merged
Conversation
aayush-kapoor
added
the
backport
gr2m
approved these changes
May 21, 2026
aayush-kapoor
added
backport
github-actions
Bot
removed
the
backport
Contributor
|
|
aayush-kapoor
added a commit
that referenced
this pull request
May 21, 2026
This is an automated backport of #15518 to the release-v6.0 branch. FYI @aayush-kapoor This backport has conflicts that need to be resolved manually. ### `git cherry-pick` output ``` Auto-merging packages/mcp/src/tool/mcp-http-transport.test.ts CONFLICT (content): Merge conflict in packages/mcp/src/tool/mcp-http-transport.test.ts Auto-merging packages/mcp/src/tool/mcp-http-transport.ts error: could not apply 6c17a9f... fix(mcp): deduplicate auth refresh on http transport (#15518) hint: After resolving the conflicts, mark them with hint: "git add/rm <pathspec>", then run hint: "git cherry-pick --continue". hint: You can instead skip this commit with "git cherry-pick --skip". hint: To abort and get back to the state before "git cherry-pick", hint: run "git cherry-pick --abort". hint: Disable this message with "git config set advice.mergeConflict false" ``` --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Aayush Kapoor <aayushkapoor34@gmail.com>
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Background
#15465
Before, both 401 paths in the transport independently called
auth():send()handles POST /mcp initialize 401.openInboundSse()handles background GET /mcp 401.that meant if one request is already refreshing tokens, any other concurrent 401 recovery would start its own recovery. this could lead to a race condition in the refresh and return invalid auth / force re auth.
Summary
authorizeOnce()that runs a single OAuth recovery flow for concurrent 401 responsesManual Verification
verified in the reproduction in the unit tests
Checklist
pnpm changesetin the project root)Related Issues
fixes #15465