OAuth connection fails after successful owner approval behind Cloudflare Named Tunnel

[fengxiaoshengofchina]

ChatGPT cannot complete the OAuth connection to DevSpace when DevSpace is exposed through a Cloudflare Named Tunnel with a custom domain.

The OAuth owner approval succeeds and DevSpace returns HTTP 302, but ChatGPT does not continue to the /token request. The connector remains disconnected.

A Cloudflare Quick Tunnel previously worked with the same local DevSpace service.

Environment

• DevSpace version: 1.0.4
• Operating system: Windows 11
• MCP local endpoint: http://127.0.0.1:7676/mcp
• Public endpoint: https://mcp.example.xyz/mcp
• Reverse proxy: Cloudflare Named Tunnel
• ChatGPT account: Plus
• Browser: Chrome

Configuration

publicBaseUrl is configured as the public origin without /mcp:

{
  "host": "127.0.0.1",
  "port": 7676,
  "allowedRoots": [
    "F:\\path\\to\\projects"
  ],
  "publicBaseUrl": "https://mcp.example.xyz"
}

The public MCP URL configured in ChatGPT is:

https://mcp.example.xyz/mcp

The custom hostname is included in the DevSpace allowed hosts.

What Works

The following checks succeed:

1. https://mcp.example.xyz/mcp returns 401 Missing Authorization header.

2. /.well-known/oauth-protected-resource/mcp works.

3. /.well-known/oauth-authorization-server works.

4. The OAuth metadata exposes:

   • authorization_endpoint
   • token_endpoint
   • registration_endpoint

5. A manual POST /register request returns 201 Created.

6. The returned Client ID is configured in ChatGPT as a custom OAuth client.

7. The registered redirect URI exactly matches the callback URL shown by ChatGPT.

8. The DevSpace owner approval page opens correctly.

9. The owner password is accepted.

10. DevSpace logs show the authorization form submission returning HTTP 302.

Actual Behavior

After clicking Authorize DevSpace:

• The authorization window closes or redirects back to ChatGPT.
• The ChatGPT connector remains disconnected.
• ChatGPT reports a connection error.
• DevSpace logs do not show a subsequent POST /token request.

Relevant log flow:

GET /authorize ... 200
POST / ... 302

The expected next request never appears:

POST /token

Reverse Proxy Issue

Before this, DevSpace produced the following error:

ERR_ERL_UNEXPECTED_X_FORWARDED_FOR
The 'X-Forwarded-For' header is set but Express 'trust proxy' is false

I temporarily fixed this locally by changing the DevSpace server code to:

app.set("trust proxy", 1);

After this change, the forwarded-header error disappeared, but the OAuth callback and token exchange problem remained.

This suggests DevSpace may need first-class reverse proxy support or a configurable trustProxy option.

Expected Behavior

After owner approval:

1. DevSpace redirects to the registered ChatGPT callback URL.
2. ChatGPT exchanges the authorization code at /token.
3. The connector becomes connected.
4. ChatGPT can discover and call the DevSpace MCP tools.

Comparison

The same local DevSpace setup previously worked through a Cloudflare Quick Tunnel using a temporary trycloudflare.com hostname.

The failure occurs when using:

• Cloudflare Named Tunnel
• A custom fixed domain
• A fresh OAuth client registration and authorization

Reproduction Steps

1. Configure DevSpace with a custom public base URL.
2. Expose port 7676 through a Cloudflare Named Tunnel.
3. Configure the public hostname to forward to http://127.0.0.1:7676.
4. Add the custom hostname to the DevSpace allowed hosts.
5. Create a ChatGPT custom MCP connector using OAuth.
6. Register the ChatGPT callback URL through POST /register.
7. Enter the generated Client ID in ChatGPT.
8. Start the connection.
9. Enter the DevSpace owner password.
10. Observe that DevSpace returns HTTP 302, but ChatGPT never calls /token.

Questions

1. Is Cloudflare Named Tunnel with a custom domain currently supported?

2. Does DevSpace require additional reverse proxy settings besides publicBaseUrl and allowed hosts?

3. Should Express trust proxy be enabled automatically or made configurable?

4. Is there a known issue with ChatGPT callback URLs or the /token exchange?

5. Can DevSpace add debug logging for:

   • The final OAuth redirect URL
   • Redirect URI validation
   • Authorization code generation
   • Token endpoint requests
   • OAuth validation failures

Please let me know which additional logs or diagnostics would be useful.