fix: allow CORS on OAuth token exchange/register for browser-based public clients - #1289
Open
sentry-junior[bot] wants to merge 1 commit into
Open
fix: allow CORS on OAuth token exchange/register for browser-based public clients#1289sentry-junior[bot] wants to merge 1 commit into
sentry-junior[bot] wants to merge 1 commit into
Conversation
…ion for browser-based public clients Browser-based OAuth clients on a different origin (e.g. the Cloudflare MCP Server Portal admin UI, MCP Inspector) cannot complete the authorization-code + PKCE exchange against mcp.sentry.dev because /oauth/token and /oauth/register unconditionally strip CORS headers. These two endpoints are protected by PKCE (and, for registration, no secret is issued to a public client), so allowing cross-origin calls does not bypass an auth boundary the way it would for cookie-authenticated routes. Reflect the requesting Origin (never *) with no Allow-Credentials, leaving every other OAuth/MCP route on the existing strip-by-default policy. Fixes #999 Co-Authored-By: David Cramer <david@sentry.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
POST https://mcp.sentry.dev/oauth/token(and/oauth/register) strip all CORS response headers unconditionally. Any browser-based OAuth client running on a different origin — the Cloudflare MCP Server Portal admin UI, MCP Inspector, etc. — is blocked at the preflight step and cannot complete the authorization-code exchange. Confirmed live:returns
204with noaccess-control-*headers.Fix
Add a third CORS policy in
packages/mcp-cloudflare/src/server/utils/cors.tsscoped to exactly/oauth/tokenand/oauth/register: reflect the requestingOrigin(never*, withVary: Origin), allowPOST, OPTIONS/Content-Type, Authorization, and never setAccess-Control-Allow-Credentials. Every other OAuth/MCP route (/oauth/authorize,/mcp, etc.) keeps the existing strip-everything default.This is safe because both endpoints are protected by PKCE (
code_verifier) rather than by CORS/cookies — the authorization code alone can't be exchanged for a token cross-origin without the verifier — matching the model other hosted MCP servers (e.g. Amplitude) already use on the same endpoint.Wired into both the OPTIONS-preflight interception and the response-finalize path in
index.ts.Testing
pnpm vitest run src/server/utils/cors.test.ts src/server/index.test.ts— 41/41 passing, including new cases for origin reflection, preflight, and the no-Origin/non-public-client strip paths.tsc --noEmitclean.Fixes #999.
Requested by David Cramer.
--
View Junior Session [Sentry]