Add `state` param to OAuth `/authorize` request by msabramo · Pull Request #3 · mcp-auth/inspector

msabramo · 2025-05-31T07:24:58Z

Add state param to OAuth /authorize request; increases security and allows OAuth to work with Okta

Motivation and Context

Some OAuth servers, such as Okta require the state parameter to be present to help prevent CSRF attacks.
More info:

upstream issue - Missing state in OAuth requests modelcontextprotocol/inspector#442
discussion - https://github.com/orgs/mcp-auth/discussions/44
article from Okta - https://support.okta.com/help/s/article/the-authentication-request-has-an-invalid-state-parameter?language=en_US

In particular, https://support.okta.com/help/s/article/the-authentication-request-has-an-invalid-state-parameter?language=en_US says:

Okta requires the OAuth 2.0 state parameter on all requests to the /authorize endpoint to prevent cross-site request forgery (CSRF). The OAuth 2.0 specification requires that clients protect their redirect URIs against CSRF by sending a value in the authorized request that binds the request to the user-agent's authenticated state. Using the state parameter is also a countermeasure to several other known attacks, as outlined in OAuth 2.0 Threat Model and Security Considerations.

How Has This Been Tested?

npm run dev
Connect to "whoami" SSE server at http://localhost:3001/sse
using a corporate Okta instance as the authorization server.
Was able to:
- successfully login
- execute a whoami tool
- verify that the tool knew info about me from OIDC.

Breaking Changes

Hopefully none

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

Additional context

Cc: @xiaoyijun, @phuctm97, @jspahrsummers, @jerome3o-anthropic

When doing an OAuth `/authorize` request to an OAuth authorization server, include a `state` parameter, as described at https://support.okta.com/help/s/article/the-authentication-request-has-an-invalid-state-parameter?language=en_US This enables OAuth to work with Okta. Fixes: https://github.com/orgs/mcp-auth/discussions/44, modelcontextprotocol#442

xiaoyijun · 2025-06-04T10:13:19Z

Hi @msabramo, thanks for your PR! I am currently considering syncing the mcp-auth fork of inspector with the official repo. Would you be open to submitting this PR to the official inspector repo as well? Of course, I will first merge this PR into the current project.

I plan to do this after modelcontextprotocol#345 is merged. If there are further updates to the official inspector repo, would you be able to help keep things in sync there?

Previously, I was syncing PRs from my personal fork to the official repo, so submitting PRs to the official repo directly from this project (mcp-auth) is a bit inconvenient.

Thanks again for your contribution!

msabramo · 2025-06-04T13:49:15Z

Hi @msabramo, thanks for your PR! I am currently considering syncing the mcp-auth fork of inspector with the official repo. Would you be open to submitting this PR to the official inspector repo as well?

You're welcome! I'm happy to contribute to the very nice work you've done here to make auth much easier in MCP and I'd be happy to submit this to the official repo tool so that even more people can benefit from it!

I already have a few PRs in the official inspector repo:
https://github.com/modelcontextprotocol/inspector/pulls/msabramo

xiaoyijun · 2025-06-04T14:25:24Z

Hi @msabramo, some tests failed—could you take a look?

msabramo · 2025-06-04T16:12:16Z

Hi @msabramo, some tests failed—could you take a look?

Well, it looks like these same errors might be happening on main, as a result of a push you did 3 weeks ago?

https://github.com/mcp-auth/inspector/actions/runs/15085688162

Since I'm looking at it now, let me see if I can fix them and submit another PR for that.

from apparently forgetting to add some new defaultProps ``` > @modelcontextprotocol/inspector-client@0.10.2 build > tsc -b && vite build src/components/__tests__/Sidebar.test.tsx:44:10 - error TS2739: Type '{ connectionStatus: "disconnected"; transportType: "stdio"; setTransportType: Mock<UnknownFunction>; command: string; setCommand: Mock<UnknownFunction>; ... 16 more ...; setConfig: Mock<...>; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 44 <Sidebar {...defaultProps} {...props} /> ~~~~~~~ src/components/__tests__/Sidebar.test.tsx:185:12 - error TS2739: Type '{ bearerToken: string; transportType: "sse"; connectionStatus: "disconnected"; setTransportType: Mock<UnknownFunction>; command: string; setCommand: Mock<UnknownFunction>; ... 15 more ...; setConfig: Mock<...>; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 185 <Sidebar ~~~~~~~ src/components/__tests__/Sidebar.test.tsx:215:12 - error TS2739: Type '{ bearerToken: string; transportType: "sse"; connectionStatus: "disconnected"; setTransportType: Mock<UnknownFunction>; command: string; setCommand: Mock<UnknownFunction>; ... 15 more ...; setConfig: Mock<...>; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 215 <Sidebar ~~~~~~~ src/components/__tests__/Sidebar.test.tsx:379:12 - error TS2739: Type '{ env: Record<string, string>; setEnv: Mock<UnknownFunction>; connectionStatus: "disconnected"; transportType: "stdio"; setTransportType: Mock<UnknownFunction>; ... 16 more ...; setConfig: Mock<...>; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 379 <Sidebar {...defaultProps} env={updatedEnv} setEnv={setEnv} /> ~~~~~~~ src/components/__tests__/Sidebar.test.tsx:414:12 - error TS2739: Type '{ env: { NEW_KEY: string; }; connectionStatus: "disconnected"; transportType: "stdio"; setTransportType: Mock<UnknownFunction>; command: string; setCommand: Mock<UnknownFunction>; ... 15 more ...; setConfig: Mock<...>; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 414 <Sidebar {...defaultProps} env={{ NEW_KEY: "test_value" }} /> ~~~~~~~ src/components/__tests__/Sidebar.test.tsx:599:12 - error TS2739: Type '{ config: InspectorConfig; setConfig: Mock<UnknownFunction>; connectionStatus: "disconnected"; transportType: "stdio"; setTransportType: Mock<...>; ... 16 more ...; loggingSupported: boolean; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 599 <Sidebar ~~~~~~~ Found 6 errors. ```

msabramo · 2025-06-04T16:15:35Z

Hi @msabramo, some tests failed—could you take a look?

Well, it looks like these same errors might be happening on main, as a result of a push you did 3 weeks ago?

https://github.com/mcp-auth/inspector/actions/runs/15085688162

Since I'm looking at it now, let me see if I can fix them and submit another PR for that.

Hi @xiaoyijun, check out #4

…h-authorize-requests

msabramo mentioned this pull request May 31, 2025

Missing state in OAuth requests modelcontextprotocol/inspector#442

Closed

msabramo added 5 commits May 31, 2025 01:54

npm run prettier-fix

a93fd44

Add generateRandomState test to oauthUtils.ts

9b34f4f

Add client/src/lib/auth.state.test.ts

04e3d72

Add client/src/lib/auth.authorize-url.test.ts

091f68e

msabramo force-pushed the send-state-parameter-for-oauth-authorize-requests branch from 0a09986 to 091f68e Compare May 31, 2025 08:56

msabramo mentioned this pull request Jun 1, 2025

Add pre-built auth // easy deployment stories PrefectHQ/fastmcp#362

Closed

xiaoyijun reviewed Jun 4, 2025

View reviewed changes

Comment thread client/src/lib/auth.ts Outdated

Replace "oauth_state" with SESSION_KEYS.OAUTH_STATE

0de8a36

msabramo added 2 commits June 4, 2025 09:16

Merge branch 'fix-ts-build-errors' into send-state-parameter-for-oaut…

0fcb78c

…h-authorize-requests

Fix type error on window.location in auth.authorize-url.test.ts

978f3d3

msabramo requested a review from xiaoyijun June 4, 2025 16:43

xiaoyijun merged commit 6523a66 into mcp-auth:main Jun 5, 2025
2 checks passed

xiaoyijun pushed a commit that referenced this pull request Jul 31, 2025

Fixing permissions (#3)

b0031d0

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `state` param to OAuth `/authorize` request#3

Add `state` param to OAuth `/authorize` request#3
xiaoyijun merged 9 commits intomcp-auth:mainfrom
msabramo:send-state-parameter-for-oauth-authorize-requests

msabramo commented May 31, 2025 •

edited

Loading

Uh oh!

xiaoyijun commented Jun 4, 2025

Uh oh!

Uh oh!

msabramo commented Jun 4, 2025

Uh oh!

xiaoyijun commented Jun 4, 2025

Uh oh!

msabramo commented Jun 4, 2025

Uh oh!

msabramo commented Jun 4, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

msabramo commented May 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

Checklist

Additional context

Uh oh!

xiaoyijun commented Jun 4, 2025

Uh oh!

Uh oh!

msabramo commented Jun 4, 2025

Uh oh!

xiaoyijun commented Jun 4, 2025

Uh oh!

msabramo commented Jun 4, 2025

Uh oh!

msabramo commented Jun 4, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

msabramo commented May 31, 2025 •

edited

Loading