client: preserve OAuth discovery metadata across browser redirects by windro-xdd · Pull Request #1816 · modelcontextprotocol/typescript-sdk

windro-xdd · 2026-03-29T14:43:38Z

Summary

persist interactive OAuth metadata (resource_metadata URL and scope) in browser sessionStorage for both Streamable HTTP and SSE client transports
restore that state on transport construction so finishAuth() works after full-page redirects
clear persisted state after successful authorization to avoid stale auth context
add regression tests for transport recreation + post-redirect finishAuth() on both transports

Why

finishAuth() can fail in browser redirect flows when the original transport instance is lost and the WWW-Authenticate metadata extracted before redirect is no longer in memory. Persisting and restoring this metadata keeps token exchange on the same discovered authorization path.

Validation

pnpm --filter @modelcontextprotocol/client typecheck
pnpm --filter @modelcontextprotocol/client lint
pnpm --filter @modelcontextprotocol/client test -- test/client/streamableHttp.test.ts test/client/sse.test.ts

Closes #1234

changeset-bot · 2026-03-29T14:43:41Z

🦋 Changeset detected

Latest commit: 317fec5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 7 packages

Name	Type
@modelcontextprotocol/server	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/express	Patch
@modelcontextprotocol/fastify	Patch
@modelcontextprotocol/hono	Patch
@modelcontextprotocol/node	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-03-29T14:45:00Z

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@1816

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@1816

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@1816

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@1816

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@1816

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@1816

commit: 317fec5

…odelcontextprotocol#1772) Co-authored-by: jnMetaCode <147776183+jnMetaCode@users.noreply.github.com> Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>

…ort (modelcontextprotocol#1763) Co-authored-by: CHOIJEWON <alsrn6040@kakao.com>

…col#1784)

…roperties (modelcontextprotocol#1766)

…l#1782)

Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>

…protocol#1632) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com> Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

…delcontextprotocol#1652) Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

…contextprotocol#1796)

…odelcontextprotocol#1770)

…elcontextprotocol#1790)

…delcontextprotocol#1824) Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>

…extprotocol#1390) Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

modelcontextprotocol#1825) Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

pcarleton

Hi, you should be able to do this with loadDiscoveryState / saveDiscoveryState, could be in an example implementation of OAuthProvider

Co-authored-by: Felix Weinberger <fweinberger@anthropic.com> Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com> Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

…lcontextprotocol#1660) Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com> Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

…l#1829)

km-anthropic · 2026-03-31T19:37:48Z

@claude review

…delcontextprotocol#1833)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…rotocol#1836)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…uestedSchema (modelcontextprotocol#1768) Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>

…ansport (modelcontextprotocol#1655) Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com> Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>

…odelcontextprotocol#1552) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…modelcontextprotocol#1788) Co-authored-by: Felix Weinberger <fweinberger@anthropic.com> Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

… redirects Add OAuthProvider class to enable stateful OAuth flows in browser-based applications. The provider persists discovery state (resource metadata URL, scopes) across OAuth redirects using sessionStorage with automatic 15-minute expiry, graceful degradation when storage is unavailable, and comprehensive error handling. Key features: - saveDiscoveryState/loadDiscoveryState for state persistence - Automatic timestamp-based expiry validation - getAuthorizationUrl for RFC 6749 OAuth 2.0 compatibility - Createable client transport with restored state - Graceful handling of missing sessionStorage (private browsing) - Try-catch wrapped storage operations Includes: - Full implementation with JSDoc documentation - Comprehensive test suite (state persistence, expiry, error handling) - OAuth_REDIRECT_EXAMPLE.md with usage patterns and security notes Fixes the issue of losing discovery state during browser redirects in interactive OAuth flows when implementing MCP-compatible web applications.

client: persist interactive OAuth metadata across redirects

45c5a0c

windro-xdd requested a review from a team as a code owner March 29, 2026 14:43

felixweinberger and others added 2 commits March 30, 2026 13:56

fix(stdio): always set windowsHide on Windows, not just in Electron (m…

5276439

…odelcontextprotocol#1772) Co-authored-by: jnMetaCode <147776183+jnMetaCode@users.noreply.github.com> Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>

feat(client): add reconnectionScheduler to StreamableHTTPClientTransp…

6711ed9

…ort (modelcontextprotocol#1763) Co-authored-by: CHOIJEWON <alsrn6040@kakao.com>

felixweinberger added the auth Issues and PRs related to Authentication / OAuth label Mar 30, 2026

felixweinberger requested a review from pcarleton March 30, 2026 16:07

wdawson and others added 17 commits March 30, 2026 18:11

SEP-2207: Refresh token guidance (modelcontextprotocol#1523)

9d08392

docs: note type vs interface for structuredContent (modelcontextproto…

9d924b1

…col#1784)

fix(core): add explicit | undefined to Transport interface optional p…

48aba0d

…roperties (modelcontextprotocol#1766)

chore(v2): pnpm audit fix (modelcontextprotocol#1789)

d0505c1

ci: format fetch-spec-types output with prettier (modelcontextprotoco…

9efecc2

…l#1782)

Private key jwt scopes (modelcontextprotocol#1443)

4aec5f7

feat!: remove WebSocketClientTransport (modelcontextprotocol#1783)

045c62a

Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>

test: add compile-time key-parity assertions for spec type checks (mo…

a39a9eb

…delcontextprotocol#1652) Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

fix(core): ensure standardSchemaToJsonSchema emits type:object (model…

d6a02c8

…contextprotocol#1796)

fix(examples): return 404 for unknown session IDs, 400 for missing (m…

8822c96

…odelcontextprotocol#1770)

fix(core): consolidate per-request cleanup in _requestWithSchema (mod…

89fb094

…elcontextprotocol#1790)

chore: drop zod from peerDependencies (kept as direct dependency) (mo…

fcde488

…delcontextprotocol#1824) Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>

Fix: Handle error responses in Streamable HTTP SSE streams (modelcont…

9bc9abc

…extprotocol#1390) Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

Add _meta support to registerPrompt (modelcontextprotocol#1629)

f73a5af

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

v2: Web standards Request object in ctx (modelcontextprotocol#1822)

2fd7f5f

Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

fix(core): make fromJsonSchema() use runtime-aware default validator … (

5f32a90

modelcontextprotocol#1825) Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

pcarleton requested changes Mar 31, 2026

View reviewed changes

andyfleming and others added 4 commits March 31, 2026 13:51

Adds Fastify Middleware for v2 (modelcontextprotocol#1536)

81e4b2a

Co-authored-by: Felix Weinberger <fweinberger@anthropic.com> Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com> Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

chore: enter alpha prerelease mode (modelcontextprotocol#1823)

0fabc27

fix(server): propagate negotiated protocol version to transport (mode…

689148d

…lcontextprotocol#1660) Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com> Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

chore(ci): remove dead publish job from main.yml (modelcontextprotoco…

babaa50

…l#1829)

felixweinberger and others added 11 commits April 1, 2026 13:30

chore(fastify): remove stray packageManager field from subpackage (mo…

38d6cd2

…delcontextprotocol#1833)

Version Packages (alpha) (modelcontextprotocol#1420)

54fa96e

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

fix(ci): split release.yml into version + publish jobs (modelcontextp…

53fb84b

…rotocol#1836)

v2 tsdown fix (modelcontextprotocol#1840)

424cbae

Version Packages (alpha) (modelcontextprotocol#1841)

0021561

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

fix(core): allow additional JSON Schema properties in elicitInput req…

866c08d

…uestedSchema (modelcontextprotocol#1768) Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>

fix(client): preserve custom Accept headers in StreamableHTTPClientTr…

1eb3123

…ansport (modelcontextprotocol#1655) Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com> Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>

Rewrite docs/server.md as a code-heavy, prose-light how-to guide (m…

653c5d0

…odelcontextprotocol#1552) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: prevent stack overflow in transport close with re-entrancy guard (…

df4b6cc

…modelcontextprotocol#1788) Co-authored-by: Felix Weinberger <fweinberger@anthropic.com> Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>

merge: resolve streamableHttp.ts conflict, keep OAuth implementation

317fec5

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

client: preserve OAuth discovery metadata across browser redirects#1816

client: preserve OAuth discovery metadata across browser redirects#1816
windro-xdd wants to merge 35 commits intomodelcontextprotocol:mainfrom
windro-xdd:fix/oauth-redirect-preserve-resource-metadata

windro-xdd commented Mar 29, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Mar 29, 2026 •

edited

Loading

Uh oh!

pkg-pr-new bot commented Mar 29, 2026 •

edited

Loading

Uh oh!

pcarleton left a comment

Uh oh!

km-anthropic commented Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

15 participants

Conversation

windro-xdd commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Validation

Uh oh!

changeset-bot bot commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

pkg-pr-new bot commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pcarleton left a comment

Choose a reason for hiding this comment

Uh oh!

km-anthropic commented Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

15 participants

windro-xdd commented Mar 29, 2026 •

edited

Loading

changeset-bot bot commented Mar 29, 2026 •

edited

Loading

pkg-pr-new bot commented Mar 29, 2026 •

edited

Loading