@cloudflare/workers-oauth-provider 1.2.0 → 1.2.1

package/dist/oauth-provider.d.ts

@@ -1098,9 +1098,11 @@ interface OAuthProviderOptions<Env = Cloudflare.Env> {
     request?: Request;
   }) => Response | void;
   /**
-   * Accept RFC 8252 private-use URI scheme redirect URIs (for example `com.example.app:/oauth`)
-   * for native apps. By default redirect URIs must use `https`, or `http` on a loopback host, as
-   * MCP and OAuth 2.1 require; remote `http` is never accepted. Leave this off for MCP servers.
+   * Let authorization requests use RFC 8252 private-use URI scheme redirect URIs (for example
+   * `com.example.app:/oauth`), for native apps. By default a request's redirect URI must use
+   * `https`, or `http` on a loopback host, as MCP and OAuth 2.1 require; remote `http` is never
+   * accepted. Without this option a client can still register private-use URIs next to a compliant
+   * one (Cursor does), but no request can use them.
    */
   allowPrivateUseRedirectUris?: boolean;
   /**

package/dist/oauth-provider.js

@@ -516,14 +516,12 @@ function validateRedirectUriSafety(redirectUri) {
 	if (dangerousSchemes.includes(scheme)) throw new Error("Invalid redirect URI");
 }
 /**
-* Validates a redirect URI against the MCP / OAuth 2.1 redirect policy: `https`, or `http` on a
-* loopback host (`localhost`, `127.0.0.0/8`, `::1`), with no userinfo and no fragment (not even an
-* empty `#`). RFC 8252 private-use schemes are accepted only when the server enables
-* `allowPrivateUseRedirectUris`; remote `http` never is. The {@link validateRedirectUriSafety}
-* checks always apply.
-* @throws Error describing why the redirect URI is not acceptable
+* The checks every redirect URI a client registers passes, whether or not this server would send a
+* code to it: the {@link validateRedirectUriSafety} checks, a parseable URI, and no fragment (not
+* even an empty `#`) or userinfo.
+* @throws Error when the redirect URI can't be registered at all
 */
-function validateRedirectUri(redirectUri, server) {
+function validateListedRedirectUri(redirectUri) {
 	validateRedirectUriSafety(redirectUri);
 	const normalized = redirectUri.trim();
 	let url;
@@ -533,6 +531,18 @@ function validateRedirectUri(redirectUri, server) {
 		throw new Error("Invalid redirect URI");
 	}
 	if (normalized.includes("#") || url.username || url.password) throw new Error("Invalid redirect URI");
+	return url;
+}
+/**
+* Validates a redirect URI against the MCP / OAuth 2.1 redirect policy: `https`, or `http` on a
+* loopback host (`localhost`, `127.0.0.0/8`, `::1`), with no userinfo and no fragment (not even an
+* empty `#`). RFC 8252 private-use schemes are accepted only when the server enables
+* `allowPrivateUseRedirectUris`; remote `http` never is. The {@link validateRedirectUriSafety}
+* checks always apply.
+* @throws Error describing why the redirect URI is not acceptable
+*/
+function validateRedirectUri(redirectUri, server) {
+	const url = validateListedRedirectUri(redirectUri);
 	if (url.protocol === "https:") return;
 	if (url.protocol === "http:") {
 		if (isLoopbackHostname(url.hostname)) return;
@@ -540,6 +550,27 @@ function validateRedirectUri(redirectUri, server) {
 	}
 	if (!server.allowPrivateUseRedirectUris) throw new Error("Redirect URI must use https, or http on a loopback host");
 }
+/**
+* Validates the redirect URIs a client registers (dynamic registration, `createClient()`,
+* `updateClient()`). A client may list callbacks for surfaces this server won't send codes to:
+* Cursor lists `cursor://anysphere.cursor-mcp/oauth/callback` next to its https and loopback
+* callbacks. So each URI is held to {@link validateListedRedirectUri}, and at least one must satisfy
+* {@link validateRedirectUri} so the client can sign in. The URI a request uses is held to the full
+* policy by `parseAuthRequest()` and `completeAuthorization()`.
+* @throws Error when a URI can't be registered, or none of them could ever receive a code
+*/
+function validateRegisteredRedirectUris(redirectUris, server) {
+	if (!redirectUris || redirectUris.length === 0) throw new Error("redirect_uris is required and must not be empty");
+	for (const redirectUri of redirectUris) validateListedRedirectUri(redirectUri);
+	let firstRefusal;
+	for (const redirectUri of redirectUris) try {
+		validateRedirectUri(redirectUri, server);
+		return redirectUris;
+	} catch (error) {
+		firstRefusal ??= error;
+	}
+	throw firstRefusal instanceof Error ? firstRefusal : /* @__PURE__ */ new Error("Invalid redirect URI");
+}
 function requireValidRedirectUris(redirectUris, validate) {
 	if (!redirectUris || redirectUris.length === 0) throw new Error("redirect_uris is required and must not be empty");
 	for (const redirectUri of redirectUris) validate(redirectUri);
@@ -560,7 +591,7 @@ function resolveDynamicClientRegistrationMetadata(raw, server) {
 	});
 	return {
 		...pickDisplayMetadata(metadata),
-		redirectUris: requireValidRedirectUris(metadata.redirectUris, (uri) => validateRedirectUri(uri, server)),
+		redirectUris: validateRegisteredRedirectUris(metadata.redirectUris, server),
 		...capabilities,
 		authMethodExplicit: metadata.tokenEndpointAuthMethod !== void 0 || metadata.tokenEndpointAuthMethodsSupported !== void 0
 	};
@@ -5309,7 +5340,7 @@ var OAuthHelpersImpl = class {
 			tokenEndpointAuthMethod,
 			...authMethodWasExplicit ? { authMethodExplicit: true } : {}
 		};
-		for (const uri of newClient.redirectUris) validateRedirectUri(uri, this.provider.serverCapabilities);
+		validateRegisteredRedirectUris(newClient.redirectUris, this.provider.serverCapabilities);
 		validateClientCapabilities(this.provider.serverCapabilities, {
 			grantTypes: newClient.grantTypes,
 			responseTypes: newClient.responseTypes,
@@ -5359,7 +5390,7 @@ var OAuthHelpersImpl = class {
 		if (!client) return null;
 		if (updates.redirectUris !== void 0) {
 			if (!Array.isArray(updates.redirectUris) || updates.redirectUris.length === 0) throw new Error("redirectUris must not be empty");
-			for (const uri of updates.redirectUris) validateRedirectUri(uri, this.provider.serverCapabilities);
+			validateRegisteredRedirectUris(updates.redirectUris, this.provider.serverCapabilities);
 		}
 		const authMethodWasExplicit = updates.tokenEndpointAuthMethod !== void 0;
 		const authMethod = updates.tokenEndpointAuthMethod || client.tokenEndpointAuthMethod || "client_secret_basic";

package/docs/authorization-server.md

@@ -71,7 +71,7 @@ CIMD validation follows [draft-ietf-oauth-client-id-metadata-document-00](https:
 
 - An HTTPS Client Identifier URL with a path component and no userinfo, fragment, or dot path segments.
 - A document `client_id` exactly matching its URL.
-- Non-empty `client_name` and `redirect_uris` fields, as MCP requires. Redirect URIs must use `https`, or `http` on a loopback host (`localhost`, `127.0.0.0/8`, `::1`), with no userinfo or fragment. The same rule applies to dynamic registration, `createClient()`, `updateClient()`, and every authorization request, so older clients are held to it too. A CIMD document may also list redirect URIs the rule refuses, such as a desktop app's private-use scheme, since every server the client uses reads the same document: those are refused only when a request uses one, and the document's https callback keeps working. Dangerous schemes such as `javascript:` still reject the whole document. Native apps using RFC 8252 private-use schemes (`com.example.app:/cb`) need `allowPrivateUseRedirectUris: true`; remote `http` is never accepted.
+- Non-empty `client_name` and `redirect_uris` fields, as MCP requires. Redirect URIs must use `https`, or `http` on a loopback host (`localhost`, `127.0.0.0/8`, `::1`), with no userinfo or fragment. Every authorization request is held to it, so older clients are too. A client may register, or list in its CIMD document, other redirect URIs next to a compliant one, because it signs in from several places: Cursor registers `cursor://anysphere.cursor-mcp/oauth/callback` beside its https and loopback callbacks. Those are stored, and refused whenever a request uses one. Dynamic registration, `createClient()` and `updateClient()` need at least one compliant redirect URI, and refuse any with a dangerous scheme such as `javascript:`, a fragment or userinfo; a dangerous scheme also rejects a whole CIMD document. Native apps using RFC 8252 private-use schemes (`com.example.app:/cb`) need `allowPrivateUseRedirectUris: true`; remote `http` is never accepted.
 - Exact authorization-request redirect URI validation, with RFC 8252 loopback port handling.
 - A 5 KB response size limit and a 10 second timeout covering both headers and body.
 - Valid UTF-8 JSON object syntax and safe URI schemes for client metadata fields.

package/docs/migration-1.0.md

@@ -103,7 +103,7 @@ If you have your own clients on either flow, move them to the authorization code
 
 ### Redirect URIs must be HTTPS or loopback HTTP (1.2)
 
-Redirect URIs must use `https`, or `http` on `localhost`, `127.0.0.0/8` or `::1`, with no userinfo or fragment. That's what MCP and OAuth 2.1 require. The rule applies at dynamic registration, in `createClient()` and `updateClient()`, and on every authorization request. A CIMD document may list other redirect URIs too, since it's shared by every server the client uses; a request that uses one of them is refused, and the rest of the document keeps working.
+Redirect URIs must use `https`, or `http` on `localhost`, `127.0.0.0/8` or `::1`, with no userinfo or fragment. That's what MCP and OAuth 2.1 require. Every authorization request is held to it. A registration (dynamic registration, `createClient()`, `updateClient()`) needs at least one redirect URI that follows it, and may list others next to it, as Cursor lists `cursor://…` beside its https and loopback callbacks; so may a CIMD document. A request that uses one of those is refused. Registrations still refuse dangerous schemes such as `javascript:`, fragments and userinfo.
 
 Because it applies at authorization too, clients registered before 1.2 are held to it. A client with a remote `http` redirect URI gets a locally rendered `invalid_request` ("Invalid redirect URI") and is never redirected. It has to register a compliant URI.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",