admin/accounted
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: broaden OAuth redirect_uri allowlist for Claude Desktop (#77)

Browse Source 
* fix: broaden OAuth redirect_uri allowlist for Claude Desktop

Claude Desktop uses varying callback paths (with org/connector IDs),
not a single fixed callback URL. Allow any path under claude.ai and
claude.com instead of requiring an exact match.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: tighten redirect_uri allowlist to /api/ prefix only

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
2026-03-21 15:52:00 +01:00
committed by GitHub
co-authored by Claude Opus 4.6
parent ff33b5a5c0
commit 51467717f1
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/mcp-oauth/authorize/route.ts
+3 -3
View File
@@ -12,10 +12,10 @@ import { createAuthCode } from '@/lib/auth/oauth-codes'
* after PKCE verification, preventing orphaned keys on abandoned flows.
*/
// Known Claude callback URLs — reject all others to prevent open redirect
// Allowed redirect URI patterns — prevent open redirect attacks
const ALLOWED_REDIRECT_PATTERNS = [
/^https:\/\/claude\.ai\/api\/mcp\/auth_callback$/,
/^https:\/\/claude\.com\/api\/mcp\/auth_callback$/,
/^https:\/\/claude\.ai\/api\//, // Claude.ai API callbacks (connector IDs vary in path)
/^https:\/\/claude\.com\/api\//, // Claude.com API callbacks
/^http:\/\/localhost(:\d+)?\//, // Local development
/^http:\/\/127\.0\.0\.1(:\d+)?\//, // Local development
]