admin/mcp-nextcloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: allow HTTPS redirect URIs for non-localhost OAuth clients

Browse Source 
Relax redirect_uri validation to accept HTTPS for remote hosts (e.g.,
cloud-hosted MCP clients like Claude AI) while keeping HTTP allowed
for localhost per RFC 8252 loopback exception.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
2026-03-29 19:03:25 +02:00
co-authored by Claude Opus 4.6
parent f151eb10b3
commit 25788eecc7
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nextcloud_mcp_server/auth/oauth_routes.py
+7 -3
View File
@@ -193,12 +193,16 @@ async def oauth_authorize(request: Request) -> RedirectResponse | JSONResponse:
status_code=400, status_code=400,
) )
# Validate redirect_uri is localhost (RFC 8252 for native clients) # Validate redirect_uri scheme security (OAuth 2.1):
if not redirect_uri.startswith(("http://localhost:", "http://127.0.0.1:")): # - Localhost: HTTP allowed (RFC 8252 loopback exception for native clients)
# - Remote hosts: HTTPS required (cloud clients like Claude AI)
parsed_redirect = parse_url(redirect_uri)
is_loopback = parsed_redirect.hostname in ("localhost", "127.0.0.1")
if not (is_loopback or parsed_redirect.scheme == "https"):
return JSONResponse( return JSONResponse(
{ {
"error": "invalid_request", "error": "invalid_request",
"error_description": "redirect_uri must be localhost for native clients", "error_description": "redirect_uri must use HTTPS for non-localhost URIs",
}, },
status_code=400, status_code=400,
) )