@automattic/mcp-wordpress-remote 0.2.2 → 0.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/proxy.js +4 -4
- package/package.json +1 -1
package/dist/proxy.js
CHANGED
|
@@ -23,7 +23,9 @@ var CONFIG = {
|
|
|
23
23
|
OAUTH_HOST: process.env.OAUTH_HOST || "127.0.0.1",
|
|
24
24
|
WP_OAUTH_CLIENT_ID: process.env.WP_OAUTH_CLIENT_ID || "",
|
|
25
25
|
// No default - site-specific
|
|
26
|
-
//
|
|
26
|
+
// OAuth flow type settings
|
|
27
|
+
// 'authorization_code' (recommended): MCP-compliant OAuth 2.1 with PKCE
|
|
28
|
+
// 'implicit' (legacy): Supported for WordPress.com and legacy implementations
|
|
27
29
|
OAUTH_FLOW_TYPE: process.env.OAUTH_FLOW_TYPE || "authorization_code",
|
|
28
30
|
OAUTH_USE_PKCE: process.env.OAUTH_USE_PKCE !== "false",
|
|
29
31
|
// PKCE required for OAuth 2.1
|
|
@@ -101,9 +103,7 @@ function validateConfig() {
|
|
|
101
103
|
errors.push("OAUTH_CALLBACK_PORT must be a valid port number (1-65535)");
|
|
102
104
|
}
|
|
103
105
|
if (CONFIG.OAUTH_FLOW_TYPE === "implicit") {
|
|
104
|
-
|
|
105
|
-
"OAUTH_FLOW_TYPE=implicit is deprecated. MCP Authorization specification 2025-06-18 requires OAuth 2.1 with authorization_code flow"
|
|
106
|
-
);
|
|
106
|
+
console.warn("\u26A0\uFE0F Using deprecated implicit OAuth flow. Consider migrating to authorization_code flow for better security.");
|
|
107
107
|
}
|
|
108
108
|
if (CONFIG.OAUTH_FLOW_TYPE === "authorization_code" && !CONFIG.OAUTH_USE_PKCE) {
|
|
109
109
|
errors.push(
|