Skip to content

Conversation

@roerohan
Copy link
Contributor

  1. The state parameter is a random generated string now (as per OAuth 2.0 spec). We validate in the callback that the same string is received.
  2. Previously, if you changed the URL for an MCP server (with oauth enabled), it would stop working. For example, if you had a gitlab MCP server and you changed the URL from https://gitlab.com/mcp to https://gitlab.mycompany.com/mcp, it would not work. To make it work, you'd have to rename the MCP server (to gitlab-2 or something) or create a new one. This PR fixes that as well.
image

Tested locally.

Added URL tracking to MCP OAuth credentials to automatically invalidate auth when server URL changes. The auth provider now validates stored credentials against the current server URL, triggering re-authentication when the URL is updated in config.
@rekram1-node
Copy link
Collaborator

/review

@github-actions
Copy link
Contributor

lgtm

@rekram1-node rekram1-node merged commit 7427b88 into sst:dev Dec 18, 2025
3 checks passed
@roerohan roerohan deleted the fix-oauth-state branch December 18, 2025 02:50
shuv1337 added a commit to Latitudes-Dev/shuvcode that referenced this pull request Dec 18, 2025
* docs: add opencode.cafe to ecosystem page (sst#5714)

* chore: format code

* docs: add legal pages with privacy policy and terms of service links

* MCP improvements (sst#5699)

* zen: error handling for stream requests

* feat(tui): add option to disable terminal title (sst#5713)

* docs: add OPENCODE_DISABLE_TERMINAL_TITLE to environment variables (sst#5725)

* chore: format code

* zen: error handling for stream requests

* tauri: server spawn fail dialog w/ copy logs button (sst#5729)

* tauri: say OpenCode Server instead of OpenCode CLI

* fix: handle empty directory query parameter in server middleware (sst#5732)

* release: v1.0.167

* sync: record last synced tag v1.0.167

---------

Co-authored-by: Ryan Vogel <[email protected]>
Co-authored-by: GitHub Action <[email protected]>
Co-authored-by: Jay V <[email protected]>
Co-authored-by: Rohan Mukherjee <[email protected]>
Co-authored-by: Frank <[email protected]>
Co-authored-by: Jake Nelson <[email protected]>
Co-authored-by: Jeon Suyeol <[email protected]>
Co-authored-by: Brendan Allan <[email protected]>
Co-authored-by: opencode <[email protected]>
Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants