Repository navigation
DEX-225: Fix MCP OAuth issuer mismatch behind the custom domain - #199
Merged
Merged
Conversation
GoTrue publishes its OAuth issuer as the raw project URL even behind the api.dexterplanner.com custom domain, so advertising the request origin failed the RFC 8414 issuer echo check in production. Also echoes allowlisted CORS origins instead of a wildcard and guards URL parsing.
✅ Deploy Preview for dexterplanner canceled.
|
|
Updates to Preview Branch (dex-225-fix-mcp-oauth-issuer) ↗︎
Tasks are run on every commit but only new migration files are pushed.
View logs for this Workflow Run ↗︎. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes DEX-225
Summary
mcp-serveradvertised its OAuth authorization server as the request origin ({origin}/auth/v1), which through the Supabase custom domain isapi.dexterplanner.com/auth/v1— but GoTrue always publishes its issuer as the raw project URL (isreileykodwkyedcewv.supabase.co/auth/v1), even behind a custom domain. MCP clients enforce the RFC 8414 §3.3 issuer echo check, so OAuth sign-in failed in production. Preview branches only worked because their origin is the project URL.SUPABASE_URL/auth/v1, keeping the/auth/v1path (the bare project URL 404s in discovery) and falling back to the request origin for local dev.Also in this diff
origin.ts) instead of a wildcard; non-browser MCP clients send no Origin header and are unaffected.new URL(req.url)calls are guarded, returning 400/empty instead of throwing.Testing
deno check --config functions/mcp-server/deno.json functions/mcp-server/index.tsdeno test --allow-all --config __tests__/deno.json __tests__/— 135 passedNotes