Repository navigation
fix(worker): require PKCE and bind consent and login to the browser - #21
Merged
Merged
Conversation
MCP clients register themselves and Auth0 skips its own consent for the one upstream application, so the Worker's consent screen is the only place a person agrees to a particular client. It was not holding that line: the request being approved travelled through the form, an approval was accepted from anywhere, and a login could finish in a browser that did not start it. /authorize also accepted requests with no PKCE challenge. - /authorize requires code_challenge with S256; plain is no longer advertised or accepted. - The pending request is kept in KV under a random single-use token. The form carries the token only. - A consent post counts only with the matching consent cookie, and /callback only with the matching login cookie. Each cookie is named after its own token so parallel sign-ins do not collide. - The consent page shows the redirect URI, says the client name is unverified, and may not be framed. - The approval cookie is renamed, so earlier approvals are void. - Invalid authorize requests answer 400 instead of 500. Cookies use the __Host- prefix over HTTPS and the bare name over HTTP, because browsers refuse the prefix there and wrangler dev serves HTTP. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pentarim
added a commit
that referenced
this pull request
Oct 1, 2026
Brings in the remote-server sign-in hardening from #21 so a Worker deploy from this branch does not revert it. One conflict, in the worker/README.md file table: kept this branch's 46-tool row and main's two rewritten rows. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
MCP clients register themselves, and Auth0 skips its own consent for the one upstream application, so the Worker's consent screen is the only place a person agrees to a particular client. This makes that screen hold.
/authorizerequirescode_challengewithS256.plainis no longer advertised or accepted./callbackonly with the matching login cookie. Each cookie is named after its own token, so parallel sign-ins do not collide.Open client registration is unchanged: the MCP authorization spec expects it.
Notes
__Host-prefix over HTTPS and the bare name over HTTP, because browsers refuse the prefix there andwrangler devserves HTTP. Production should have Always Use HTTPS on for the zone.mcp.tribeunal.com(version24c24cb6), ahead of this PR, because the repository is public.Testing
npm run test:unit: 259 pass, 21 of them new intests/worker-oauth-consent.test.ts.npx tsc --noEmitinworker/is clean.wrangler dev, in a real browser up to the Auth0 page, and against production after the deploy.🤖 Generated with Claude Code