fix(mcp): leave SDK redirect policy at same-origin

`redirectPolicy: "follow"` made SDK 1.32.1 follow 307/308 on OAuth
discovery and token requests, so refresh tokens and auth codes could
be posted off-origin. Omit the override and keep the SDK default.

Author: TheGreatAxios

src/mcp/client-auth-policy.test.ts

@@ -184,9 +184,9 @@ describe("HTTP MCP auth policy", () => {
     });
     expect(callbackStarts).toBe(0);
     expect(providerCreates).toBe(0);
-    // No signal and no provider: still pins the operator-configured-host
-    // redirect policy rather than the SDK 1.32 same-origin default.
-    expect(transportOptions).toEqual([{ redirectPolicy: "follow" }]);
+    // No signal and no provider: leave redirectPolicy unset so the SDK
+    // default `same-origin` applies. Do not pin `follow`.
+    expect(transportOptions).toEqual([{}]);
   });
 
   test("closes a bound OAuth callback server when provider setup fails", async () => {
@@ -265,7 +265,6 @@ describe("HTTP MCP auth policy", () => {
         authProvider,
         requestInit: { signal: expect.any(AbortSignal) },
         fetch: expect.any(Function),
-        redirectPolicy: "follow",
       },
     ]);
 
@@ -302,7 +301,6 @@ describe("HTTP MCP auth policy", () => {
         authProvider,
         requestInit: { signal: expect.any(AbortSignal) },
         fetch: expect.any(Function),
-        redirectPolicy: "follow",
       },
     ]);
   });

src/mcp/client-redirect-policy.test.ts

@@ -0,0 +1,109 @@
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { describe, expect, test } from "bun:test";
+import { saveAuthState } from "./auth-store.js";
+import { streamableHTTPTransportOptions } from "./client.js";
+import { createOAuthProvider } from "./oauth-provider.js";
+
+const SERVER_URL = "https://mcp.example/mcp";
+const OFF_ORIGIN = "https://evil.example/collect";
+
+function json(body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+describe("HTTP MCP redirect policy", () => {
+  test("discovery and token fetches do not follow a cross-origin redirect", async () => {
+    const home = await mkdtemp(join(tmpdir(), "mcp-redirect-"));
+    const identity = { serverName: "example", serverURL: SERVER_URL };
+    await saveAuthState(
+      identity,
+      {
+        clientInformation: {
+          client_id: "client",
+          redirect_uris: ["http://127.0.0.1:1/callback"],
+          client_id_issued_at: 1,
+          token_endpoint_auth_method: "none",
+          grant_types: ["authorization_code", "refresh_token"],
+          response_types: ["code"],
+          client_name: "interchange-code",
+        },
+      },
+      home,
+    );
+    const provider = await createOAuthProvider({
+      serverName: identity.serverName,
+      serverURL: identity.serverURL,
+      redirectUrl: "http://127.0.0.1:1/callback",
+      onAuthURL: () => undefined,
+      home,
+    });
+    await provider.saveCodeVerifier("verifier");
+
+    const abort = new AbortController();
+    const options = streamableHTTPTransportOptions(provider, abort.signal);
+    expect(options).not.toHaveProperty("redirectPolicy");
+
+    const requested: string[] = [];
+    const fetchFn = async (
+      url: string | URL,
+      init?: RequestInit,
+    ): Promise<Response> => {
+      const href = String(url);
+      requested.push(href);
+      const target = new URL(href);
+      if (target.hostname === "evil.example") {
+        return new Response("collected", { status: 200 });
+      }
+      const crossOrigin =
+        target.pathname === "/.well-known/oauth-protected-resource/mcp" ||
+        target.pathname === "/oauth/token";
+      if (!crossOrigin) {
+        if (target.pathname === "/.well-known/oauth-protected-resource") {
+          return json({
+            resource: SERVER_URL,
+            authorization_servers: ["https://mcp.example"],
+          });
+        }
+        if (target.pathname === "/.well-known/oauth-authorization-server") {
+          return json({
+            issuer: "https://mcp.example",
+            authorization_endpoint: "https://mcp.example/authorize",
+            token_endpoint: "https://mcp.example/oauth/token",
+            response_types_supported: ["code"],
+          });
+        }
+        return new Response(null, { status: 404 });
+      }
+      const redirect = new Response(null, {
+        status: 308,
+        headers: { location: OFF_ORIGIN },
+      });
+      const mode = init?.redirect ?? "follow";
+      if (mode === "error") throw new TypeError("redirect mode is error");
+      if (mode === "manual") return redirect;
+      return fetchFn(OFF_ORIGIN, init);
+    };
+
+    const transport = new StreamableHTTPClientTransport(new URL(SERVER_URL), {
+      ...options,
+      fetch: fetchFn,
+    });
+    await expect(transport.finishAuth("auth-code")).rejects.toThrow();
+
+    expect(requested.some((href) => href.includes("evil.example"))).toBe(false);
+    expect(
+      requested.some((href) =>
+        href.includes("/.well-known/oauth-protected-resource/mcp"),
+      ),
+    ).toBe(true);
+    expect(requested.some((href) => href.includes("/oauth/token"))).toBe(true);
+    const tokenPost = requested.find((href) => href.includes("/oauth/token"));
+    expect(tokenPost?.startsWith("https://mcp.example/")).toBe(true);
+  });
+});

src/mcp/client.ts

@@ -405,21 +405,18 @@ export function fetchWithConnectAbort(
   };
 }
 
-function streamableHTTPTransportOptions(
+export function streamableHTTPTransportOptions(
   authProvider: CorbitsOAuthProvider | undefined,
   signal: AbortSignal | undefined,
 ) {
-  // SDK 1.32 flips the client transports' default redirect handling to
-  // same-origin-only. MCP endpoint URLs are operator-configured (user
-  // settings, or trust-on-first-use local servers), so trust redirects from
-  // the chosen origin: keep the pre-1.32 behavior of letting fetch follow
-  // them rather than failing on a legit cross-origin hop.
+  // Leave redirectPolicy unset. SDK 1.32 defaults to `same-origin`; `follow`
+  // also wraps OAuth discovery and token requests, so a 307/308 can post
+  // refresh tokens or auth codes to another host.
   return {
     ...(authProvider === undefined ? {} : { authProvider }),
     ...(signal === undefined
       ? {}
       : { requestInit: { signal }, fetch: fetchWithConnectAbort(signal) }),
-    redirectPolicy: "follow" as const,
   };
 }