Armin Ronacher c5f5b3282d fix(mcp): reject iss when no authorization server metadata was discovered ... Without metadata there is no issuer to compare an RFC 9207 iss parameter with, so the check was skipped and a malicious MCP server could receive a code from another authorization server. Reject the response before the code exchange instead. Reported by Alexios Stefanopoulos (@AizenvoltPrime).		2026-10-10 14:44:35 +02:00
..
fixtures	feat(coding-agent): codemode and MCP	2026-09-29 09:12:50 +02:00
client.test.ts	fix(mcp): treat empty and null optional OAuth fields as absent	2026-10-01 02:05:35 +02:00
content.test.ts	feat(coding-agent): codemode and MCP	2026-09-29 09:12:50 +02:00
helpers.ts	feat(coding-agent): codemode and MCP	2026-09-29 09:12:50 +02:00
oauth.test.ts	fix(mcp): reject iss when no authorization server metadata was discovered	2026-10-10 14:44:35 +02:00
stdio.test.ts	feat(coding-agent): codemode and MCP	2026-09-29 09:12:50 +02:00
streamable-http.test.ts	fix(coding-agent): cancel MCP OAuth sign-ins and stop refreshing on close	2026-10-07 16:18:46 +02:00