Skip to content

Preserve OAuth authorize URL through sign-in redirect - #22

Merged
UsamaSadiq merged 1 commit into
foss-sandboxfrom
usama/fix-mcp-oauth-redirect
Jul 15, 2026
Merged

Preserve OAuth authorize URL through sign-in redirect#22
UsamaSadiq merged 1 commit into
foss-sandboxfrom
usama/fix-mcp-oauth-redirect

Conversation

@UsamaSadiq

Copy link
Copy Markdown
Collaborator

Description

When an unauthenticated user hits /authorize during MCP OAuth (e.g. from Claude.ai), PageChangeEffect discards the full OAuth URL (client_id, redirect_uri, state, code_challenge) and redirects to /sign-in-up. After login the user lands on the homepage instead of returning to the OAuth consent page.

Fix: encode the full /authorize?... URL as returnToPath so the existing post-login redirect mechanism routes back to the consent flow with all OAuth params intact.

Testing

  1. Add Twenty MCP connector in Claude.ai: https://twenty.moneta.askii.ai/mcp
  2. When not logged into Twenty, the OAuth flow should redirect to sign-in, then after login return to the authorize consent page
  3. After clicking "Authorize", the browser should redirect back to Claude.ai (not the Twenty homepage)

When an unauthenticated user hits /authorize during MCP OAuth,
PageChangeEffect discards the full URL (client_id, redirect_uri,
state, code_challenge) and redirects to /sign-in-up. After login
the user lands on the homepage instead of returning to the OAuth
consent page.

Encode the full /authorize?... URL as returnToPath so the existing
post-login redirect mechanism routes back to the consent flow.
@UsamaSadiq
UsamaSadiq merged commit 8a862d7 into foss-sandbox Jul 15, 2026
60 of 65 checks passed
@github-actions

Copy link
Copy Markdown
Fails
🚫

node failed.

Log

Details
�[31mError: �[39m SyntaxError: Unexpected token '<', "<!DOCTYPE "... is not valid JSON
    at JSON.parse (<anonymous>)
�[90m    at parseJSONFromBytes (node:internal/deps/undici/undici:4387:19)�[39m
�[90m    at successSteps (node:internal/deps/undici/undici:7041:27)�[39m
�[90m    at readAllBytes (node:internal/deps/undici/undici:5958:13)�[39m
�[90m    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)�[39m
danger-results://tmp/danger-results-0793c22f.json

Generated by 🚫 dangerJS against b90aa0e

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant