@context-engine-bridge/context-engine-mcp-bridge 0.0.87 → 0.0.88

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@context-engine-bridge/context-engine-mcp-bridge",
-  "version": "0.0.87",
+  "version": "0.0.88",
   "description": "Context Engine MCP bridge (http/stdio proxy combining indexer + memory servers)",
   "bin": {
     "ctxce": "bin/ctxce.js",
@@ -17,6 +17,7 @@
     "test:e2e:ui": "playwright test --ui"
   },
   "dependencies": {
+    "@context-engine-bridge/context-engine-mcp-bridge": "^0.0.87",
     "@modelcontextprotocol/sdk": "^1.24.3",
     "ignore": "^7.0.5",
     "tar": "^7.5.9",

package/src/oauthHandler.js

@@ -458,6 +458,9 @@ export function handleOAuthStoreSession(req, res) {
         code_challenge_method,
         client_id,
       } = data;
+      const normalizedCodeChallengeMethod = code_challenge
+        ? (code_challenge_method || "S256")
+        : (code_challenge_method || null);
 
       if (!session_id || !backend_url) {
         res.statusCode = 400;
@@ -488,6 +491,15 @@ export function handleOAuthStoreSession(req, res) {
         return;
       }
 
+      if (code_challenge && normalizedCodeChallengeMethod !== "S256") {
+        res.statusCode = 400;
+        res.end(JSON.stringify({
+          error: "invalid_request",
+          error_description: "Unsupported code_challenge_method",
+        }));
+        return;
+      }
+
       // Additional CSRF protection: verify request came from a local browser origin
       // Require Origin or Referer header to be present and from localhost
       const origin = req.headers["origin"] || req.headers["referer"];
@@ -528,7 +540,7 @@ export function handleOAuthStoreSession(req, res) {
         sessionId: session_id,
         backendUrl: backend_url,
         codeChallenge: code_challenge,
-        codeChallengeMethod: code_challenge_method,
+        codeChallengeMethod: normalizedCodeChallengeMethod,
         redirectUri: redirect_uri,
         createdAt: Date.now(),
       });
@@ -605,7 +617,17 @@ export function handleOAuthToken(req, res) {
       }
 
       // PKCE validation (RFC 7636)
-      if (pendingData.codeChallenge && pendingData.codeChallengeMethod === "S256") {
+      if (pendingData.codeChallenge) {
+        const codeChallengeMethod = pendingData.codeChallengeMethod || "S256";
+        if (codeChallengeMethod !== "S256") {
+          pendingCodes.delete(code);
+          res.statusCode = 400;
+          res.end(JSON.stringify({
+            error: "invalid_grant",
+            error_description: "Unsupported code_challenge_method",
+          }));
+          return;
+        }
         if (!codeVerifier) {
           pendingCodes.delete(code);
           res.statusCode = 400;