OAuth client: harden SEP-2352/SEP-2350 edge cases; fix conformance comment - #2936
Merged
Claude / Claude Code Review
completed
Jun 20, 2026 in 19m 43s
Code review found 1 potential issue
Found 5 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/mcp/client/auth/oauth2.py:591-599 |
Mis-bound DCR record can still persist when ASM rediscovery fails after issuer change |
Annotations
Check warning on line 599 in src/mcp/client/auth/oauth2.py
claude / Claude Code Review
Mis-bound DCR record can still persist when ASM rediscovery fails after issuer change
When the issuer changes but ASM discovery for the new AS fails in the same flow, Step 4 still falls back to `urljoin(resource-origin, '/register')` and stamps `client_information.issuer = auth_server_url` (the new AS) on credentials actually registered with the old embedded AS — persisting exactly the mis-bound record the `oauth_metadata = None` clear is meant to prevent, and `credentials_match_issuer` will then accept it on every later 401 with no auto-recovery. Consider failing the flow (or sk
Loading