OOOOOAO
1a6503a520
fix(mcp): thread RFC 9207 iss through every OAuth callback relay
...
mcp 2.x rejects an authorization response that omits the RFC 9207 `iss`
parameter when the authorization server advertised
`authorization_response_iss_parameter_supported`. Cloudflare advertises it
AND sends it; the CLI loopback handler has always forwarded it, but every
other callback producer parsed only code/state/error, so the SDK raised:
OAuthFlowError: Authorization response missing iss parameter
advertised by the authorization server
and the server parked. Same machine, same config, `hermes mcp login <name>`
from a terminal succeeded — the failure is specific to the non-CLI relays.
Forward `iss` on every producer, matching `_make_callback_handler()`:
- tools/mcp_dashboard_oauth.py: `deliver_callback()` accepts `iss`;
`wait_for_callback()` returns `(code, state, iss)`. The bridge in
tools/mcp_oauth.py already splats that tuple into
`_authorization_code_result(code, state, iss)`, so it needs no change.
- tui_gateway/mcp_oauth_sessions.py: the gateway-hosted loopback listener
parses `iss`, and `deliver_callback_flow()` forwards it.
- tui_gateway/methods_tools.py: the `oauth.callback` RPC passes `iss`.
- hermes_cli/web_routers/mcp.py: the dashboard callback route accepts it.
- apps/desktop/electron/mcp-oauth-callback-ipc.ts: the one-shot listener
reads `iss` off the redirect (the renderer already spreads the whole
callback object into the RPC, so it flows through unchanged).
Providers that omit `iss` round-trip as `None`/`null` rather than being
dropped, so servers that do not advertise RFC 9207 keep working.
Verified live on Windows against mcp.cloudflare.com, whose metadata sets
`authorization_response_iss_parameter_supported: true`: the server that
previously parked on the missing-iss error now reports
`Authenticated — 3452 tool(s) available` and `hermes mcp test cloudflare`
connects. State-mismatch and replay rejection are unchanged.
Tests (each fails on base, passes with the fix):
- test_dashboard_flow_preserves_rfc9207_iss
- test_deliver_callback_forwards_iss (client-redirect relay)
- test_loopback_listener_forwards_iss (real HTTP redirect)
- two vitest cases on the Electron listener, incl. the iss-absent case
Refs #92758 , #99984 . PR #92765 fixes the dashboard route and the loopback
listener but not the client-redirect relay
(`deliver_callback_flow` / `oauth.callback` / the Electron listener), which
is the path Desktop drives against a remote backend.
2026-09-15 13:00:12 +05:30
..
2026-08-15 02:20:23 -07:00
2026-09-09 21:34:06 -04:00
2026-07-26 16:12:14 -05:00
2026-07-26 16:12:14 -05:00
2026-09-11 12:53:07 +05:30
2026-09-11 12:53:07 +05:30
2026-08-26 18:44:46 +00:00
2026-08-26 18:44:46 +00:00
2026-09-11 07:33:17 -05:00
2026-09-01 00:41:26 +00:00
2026-09-15 10:50:53 +05:30
2026-08-27 11:26:57 +05:30
2026-08-27 11:26:57 +05:30
2026-09-11 07:33:17 -05:00
2026-09-15 10:50:53 +05:30
2026-09-06 14:37:30 +05:30
2026-08-26 04:49:56 -07:00
2026-08-02 03:33:09 +00:00
2026-08-01 20:09:35 -04:00
2026-09-11 07:33:17 -05:00
2026-09-11 12:53:07 +05:30
2026-09-11 12:53:07 +05:30
2026-09-11 07:33:17 -05:00
2026-09-11 07:33:17 -05:00
2026-09-15 10:50:53 +05:30
2026-09-15 10:50:53 +05:30
2026-08-23 18:38:31 +00:00
2026-09-08 00:13:36 +00:00
2026-09-08 02:30:34 +05:30
2026-08-31 20:43:36 -05:00
2026-08-31 20:43:36 -05:00
2026-08-26 06:51:21 +00:00
2026-08-26 06:51:21 +00:00
2026-08-26 06:51:21 +00:00
2026-09-15 10:50:53 +05:30
2026-09-15 10:50:53 +05:30
2026-09-11 07:33:17 -05:00
2026-09-11 12:53:07 +05:30
2026-09-11 12:53:07 +05:30
2026-08-13 03:33:45 +00:00
2026-07-14 10:24:15 -04:00
2026-09-11 07:33:17 -05:00
2026-07-31 22:33:53 -07:00
2026-08-01 20:45:40 +00:00
2026-07-19 23:42:14 +00:00
2026-09-11 07:33:17 -05:00
2026-08-25 23:31:59 +00:00
2026-08-25 18:23:43 -05:00
2026-09-01 22:33:29 -05:00
2026-09-01 22:33:29 -05:00
2026-09-01 22:33:29 -05:00
2026-09-01 22:33:29 -05:00
2026-09-12 10:00:08 +05:30
2026-09-12 05:09:01 -07:00
2026-09-11 07:33:17 -05:00
2026-09-11 07:33:17 -05:00
2026-08-23 20:26:46 -05:00
2026-08-23 20:26:46 -05:00
2026-09-12 13:20:20 +00:00
2026-09-12 06:13:44 -07:00
2026-09-08 06:53:22 -07:00
2026-09-08 06:53:22 -07:00
2026-08-23 05:06:17 +00:00
2026-07-27 13:41:59 -05:00
2026-07-27 13:41:59 -05:00
2026-07-13 17:22:17 -04:00
2026-07-08 16:24:16 -07:00
2026-07-16 19:57:39 +00:00
2026-07-20 23:01:49 +02:00
2026-07-20 23:01:49 +02:00
2026-08-15 01:04:19 -07:00
2026-08-15 01:04:19 -07:00
2026-08-18 21:51:44 +00:00
2026-08-18 21:51:44 +00:00
2026-09-10 15:26:17 +00:00
2026-09-10 08:19:55 -07:00
2026-09-05 18:20:20 +05:30
2026-09-05 18:20:20 +05:30
2026-07-13 17:22:17 -04:00
2026-07-13 17:22:17 -04:00
2026-07-27 23:52:33 -05:00
2026-07-27 23:52:33 -05:00
2026-07-08 16:24:16 -07:00
2026-07-28 13:40:44 -05:00
2026-08-25 23:33:46 -07:00
2026-09-10 09:38:07 -07:00
2026-09-10 09:38:07 -07:00
2026-08-14 21:44:50 +00:00
2026-08-14 16:27:01 -05:00
2026-08-20 14:07:53 -05:00
2026-08-20 14:07:53 -05:00
2026-09-11 12:53:17 +00:00
2026-07-23 17:59:58 -07:00
2026-07-23 17:59:58 -07:00
2026-08-15 02:20:23 -07:00
2026-08-15 09:33:47 +00:00
2026-08-15 09:33:47 +00:00
2026-07-24 12:55:06 -05:00
2026-07-24 12:55:06 -05:00
2026-09-15 10:50:53 +05:30
2026-09-10 15:26:17 +00:00
2026-07-13 17:22:17 -04:00
2026-07-12 05:32:54 -04:00
2026-09-11 12:53:07 +05:30
2026-08-29 11:33:05 +05:30
2026-09-07 07:11:36 -07:00
2026-09-07 07:11:36 -07:00
2026-09-01 08:34:56 +00:00
2026-09-01 08:34:56 +00:00
2026-08-17 04:19:24 +00:00
2026-08-16 19:58:49 -07:00
2026-08-14 16:51:00 -05:00
2026-08-19 10:50:52 -05:00
2026-08-26 11:57:06 +00:00
2026-08-26 11:57:06 +00:00
2026-08-03 00:08:30 +05:30
2026-08-12 22:48:00 -05:00
2026-07-13 17:22:17 -04:00
2026-07-08 16:24:16 -07:00
2026-08-15 00:33:11 -07:00
2026-08-15 00:33:11 -07:00
2026-08-15 11:39:10 +00:00
2026-08-15 11:39:10 +00:00
2026-09-12 10:00:06 +05:30
2026-09-14 13:41:54 -04:00
2026-08-12 01:41:34 +00:00
2026-08-11 17:03:00 -05:00
2026-08-26 04:49:22 -07:00
2026-08-23 21:12:26 -07:00
2026-09-10 08:19:13 -07:00
2026-09-10 08:19:13 -07:00
2026-08-08 22:15:24 -05:00
2026-08-08 22:15:24 -05:00
2026-08-28 15:33:19 -05:00
2026-08-28 15:33:19 -05:00
2026-08-23 22:34:38 -05:00
2026-08-23 22:34:38 -05:00
2026-08-24 06:48:10 -05:00
2026-08-24 06:48:10 -05:00
2026-08-24 17:03:13 +00:00
2026-09-10 09:37:47 -07:00
2026-08-28 15:33:19 -05:00
2026-09-08 22:57:02 -04:00
2026-08-24 14:11:49 -05:00
2026-08-10 05:21:05 -05:00
2026-08-10 10:44:00 +00:00
2026-08-10 05:21:05 -05:00
2026-08-10 10:44:00 +00:00
2026-08-09 09:10:59 +00:00
2026-08-09 09:10:59 +00:00
2026-08-29 00:51:43 -05:00
2026-08-29 00:51:43 -05:00
2026-08-09 09:51:41 +00:00
2026-08-24 11:57:38 -05:00
2026-09-12 10:00:08 +05:30
2026-09-04 23:19:11 -07:00
2026-09-04 23:19:11 -07:00
2026-09-15 10:50:53 +05:30
2026-09-11 07:33:17 -05:00
2026-07-16 19:57:39 +00:00
2026-07-16 15:33:38 -04:00
2026-09-15 10:50:53 +05:30
2026-08-27 01:31:15 +00:00
2026-08-27 01:31:15 +00:00
2026-09-15 13:00:12 +05:30
2026-09-15 13:00:12 +05:30
2026-09-11 10:17:09 -05:00
2026-09-11 07:32:34 -05:00
2026-09-11 07:37:59 -05:00
2026-09-11 19:00:50 +00:00
2026-09-11 07:32:34 -05:00
2026-09-11 07:32:34 -05:00
2026-09-11 12:53:07 +05:30
2026-09-11 12:53:07 +05:30
2026-07-22 16:30:14 +00:00
2026-07-22 16:30:14 +00:00
2026-08-26 00:40:35 -07:00
2026-08-26 00:40:35 -07:00
2026-07-31 10:16:21 -04:00
2026-07-31 10:16:21 -04:00
2026-09-09 23:37:48 -05:00
2026-09-09 23:37:48 -05:00
2026-09-10 04:43:55 +00:00
2026-09-09 23:37:48 -05:00
2026-09-10 04:49:08 +00:00
2026-09-10 04:43:55 +00:00
2026-09-10 04:43:55 +00:00
2026-09-11 07:32:34 -05:00
2026-07-13 17:22:17 -04:00
2026-07-08 16:24:16 -07:00
2026-08-26 21:44:19 +00:00
2026-08-26 21:44:19 +00:00
2026-09-11 07:32:34 -05:00
2026-09-11 07:32:34 -05:00
2026-09-11 07:14:55 -05:00
2026-08-20 04:47:38 -07:00
2026-08-20 04:47:38 -07:00
2026-08-19 10:50:52 -05:00
2026-09-04 18:28:32 +00:00
2026-09-04 18:28:32 +00:00
2026-08-26 07:45:59 +00:00
2026-08-26 00:22:27 -07:00
2026-09-11 06:23:18 -07:00
2026-09-11 06:23:18 -07:00
2026-09-03 07:24:01 +00:00
2026-09-03 12:19:05 +05:30
2026-09-11 06:23:18 -07:00
2026-09-06 14:37:30 +05:30
2026-09-14 19:56:15 +05:30
2026-09-14 19:56:15 +05:30
2026-08-16 16:26:50 -07:00
2026-08-16 16:26:50 -07:00
2026-08-26 11:57:06 +00:00
2026-07-20 11:50:22 -05:00
2026-07-20 11:50:22 -05:00
2026-09-12 05:09:01 -07:00
2026-09-01 07:41:45 +00:00
2026-09-01 00:30:56 -07:00
2026-08-18 08:52:36 -05:00
2026-08-18 08:52:36 -05:00
2026-08-18 08:52:36 -05:00
2026-09-15 10:50:53 +05:30
2026-09-15 10:50:53 +05:30
2026-09-15 10:50:53 +05:30
2026-07-24 12:55:06 -05:00
2026-09-11 19:00:50 +00:00
2026-09-11 06:23:18 -07:00
2026-08-23 08:45:37 +00:00
2026-08-20 10:26:19 -04:00
2026-09-01 15:24:33 -04:00
2026-09-01 20:48:06 +00:00
2026-08-17 16:15:22 -07:00
2026-08-17 16:15:22 -07:00
2026-08-25 22:51:31 -07:00
2026-08-25 22:51:31 -07:00
2026-07-26 17:48:19 -07:00
2026-07-31 18:54:27 +00:00
2026-07-27 15:47:57 -05:00
2026-07-27 15:47:57 -05:00
2026-09-11 07:33:17 -05:00
2026-09-11 07:33:17 -05:00
2026-09-11 12:26:01 +05:30
2026-09-09 12:09:00 -07:00
2026-09-11 03:45:33 +05:30
2026-09-11 06:22:35 -07:00
2026-09-11 06:22:35 -07:00
2026-09-11 12:53:17 +00:00
2026-09-11 12:53:17 +00:00
2026-09-11 12:53:07 +05:30
2026-08-26 00:40:35 -07:00
2026-08-26 00:40:35 -07:00
2026-08-24 03:22:38 -07:00
2026-08-24 17:03:13 +00:00
2026-08-26 23:21:02 +00:00
2026-08-26 23:21:02 +00:00
2026-08-11 00:20:02 +00:00
2026-08-11 00:20:02 +00:00
2026-09-09 12:13:14 -07:00
2026-09-09 12:13:14 -07:00
2026-08-25 14:10:19 -07:00
2026-08-25 14:10:19 -07:00
2026-09-02 06:47:55 -07:00
2026-09-02 06:47:55 -07:00
2026-09-11 07:32:00 +00:00
2026-09-10 20:08:03 +02:00
2026-07-25 15:19:29 -04:00
2026-07-25 15:19:29 -04:00
2026-09-14 20:22:49 +05:30
2026-09-14 20:22:49 +05:30
2026-07-20 23:01:49 +02:00
2026-07-20 23:01:49 +02:00
2026-08-31 12:16:48 -07:00
2026-08-31 12:16:48 -07:00
2026-09-14 19:56:15 +05:30
2026-09-14 19:56:15 +05:30
2026-09-11 07:33:17 -05:00
2026-09-11 07:33:17 -05:00
2026-07-31 00:38:11 -05:00
2026-07-31 00:38:11 -05:00
2026-08-26 06:20:59 +00:00
2026-09-12 08:18:50 -07:00
2026-09-12 08:18:50 -07:00
2026-08-31 19:43:31 -05:00
2026-08-31 19:43:31 -05:00
2026-07-13 17:22:17 -04:00
2026-07-08 16:24:16 -07:00
2026-09-08 18:45:42 -05:00
2026-08-21 05:57:14 +00:00
2026-09-10 18:15:54 -07:00
2026-09-10 18:15:54 -07:00
2026-09-11 07:33:17 -05:00
2026-07-28 23:53:25 -07:00
2026-09-11 07:33:17 -05:00
2026-08-20 18:15:16 +00:00
2026-08-20 12:52:21 -05:00
2026-08-20 18:15:16 +00:00
2026-09-07 05:55:26 -07:00
2026-07-13 17:22:17 -04:00
2026-07-13 17:22:17 -04:00
2026-08-14 21:59:29 -07:00
2026-09-07 13:53:40 +00:00
2026-09-01 08:34:56 +00:00
2026-08-31 12:00:33 -07:00
2026-09-01 08:34:56 +00:00
2026-09-01 08:34:56 +00:00
2026-07-13 17:22:17 -04:00
2026-07-08 16:24:16 -07:00
2026-08-10 19:00:19 -07:00
2026-08-10 19:00:19 -07:00
2026-08-01 14:30:11 -07:00
2026-09-15 10:49:40 +05:30
2026-09-15 10:49:40 +05:30
2026-09-05 18:20:20 +05:30
2026-09-05 18:20:20 +05:30
2026-09-12 10:00:08 +05:30
2026-09-04 23:19:11 -07:00
2026-08-26 23:21:02 +00:00
2026-08-26 15:51:22 -07:00
2026-08-08 16:51:44 -05:00
2026-08-08 16:51:44 -05:00
2026-08-08 22:13:08 -05:00
2026-08-08 22:17:38 -05:00
2026-08-10 17:02:56 -07:00
2026-07-13 17:22:17 -04:00
2026-09-15 10:50:53 +05:30
2026-09-15 10:50:53 +05:30
2026-08-27 01:31:15 +00:00
2026-08-27 01:31:15 +00:00
2026-07-20 23:01:49 +02:00
2026-07-18 02:26:19 -07:00
2026-07-18 02:26:19 -07:00
2026-09-10 03:02:40 +00:00
2026-09-10 03:02:40 +00:00
2026-07-13 17:22:17 -04:00
2026-07-13 17:22:17 -04:00
2026-07-13 17:22:17 -04:00
2026-07-08 16:24:16 -07:00
2026-07-13 17:22:17 -04:00
2026-07-08 16:24:16 -07:00
2026-08-21 00:49:41 -07:00
2026-08-21 00:49:41 -07:00
2026-09-09 12:09:00 -07:00
2026-09-09 19:21:46 +00:00
2026-08-24 22:01:47 -05:00
2026-08-24 22:01:47 -05:00