Treat redirected token and registration responses as terminal

The token-exchange and client-registration POSTs followed HTTP redirects,
re-sending the request body to whatever target the Location header named.
Token responses are terminal (RFC 6749 §5): these requests are now issued
with redirect: 'manual', and a 3xx answer (or a redirect the runtime
filtered as opaque) rejects with an error instead of being re-sent.

Author: felixweinberger

.changeset/token-registration-redirects-terminal.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/client': patch
+---
+
+Token and client registration requests no longer follow HTTP redirects. Token responses are terminal (RFC 6749 §5), so a 3xx answer from the token or registration endpoint now rejects with an error instead of being re-sent to the redirect target.

docs/migration/upgrade-to-v2.md

@@ -1120,6 +1120,13 @@ OAuth `onUnauthorized` behavior, for composing your own adapter).
   than the MCP server, so connection-level headers do not carry over. A deployment that
   needs extra headers on those requests (e.g. gateway headers on well-known endpoints)
   sets the new `oauthRequestInit` transport option.
+- **Token and registration endpoint redirects are not followed.** The token-exchange
+  and client-registration POSTs (`exchangeAuthorization()` / `refreshAuthorization()` /
+  `fetchToken()` / `registerClient()`, transitively `auth()`) are issued with
+  `redirect: 'manual'`; a 3xx answer rejects with an error instead of re-sending the
+  request to the redirect target. Token responses are terminal (RFC 6749 §5) — an
+  authorization server that redirects these requests must be addressed at its final
+  endpoint URL (via its metadata document).
 - **Scoped credential invalidation on `invalid_client` / `unauthorized_client`.** The
   `auth()` retry for these errors now issues two scoped calls —
   `invalidateCredentials('client')` then `invalidateCredentials('tokens')` — instead of

packages/client/src/client/auth.ts

@@ -2090,9 +2090,17 @@ export async function executeTokenRequest(
     const response = await (fetchFn ?? fetch)(tokenUrl, {
         method: 'POST',
         headers,
-        body: tokenRequestParams
+        body: tokenRequestParams,
+        // Token responses are terminal (RFC 6749 §5): a redirect is not followed.
+        redirect: 'manual'
     });
 
+    if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400)) {
+        throw new Error(
+            `Token endpoint responded with a redirect (HTTP ${response.status || 'filtered by the runtime'}); token responses are terminal`
+        );
+    }
+
     if (!response.ok) {
         throw await parseErrorResponse(response);
     }
@@ -2365,9 +2373,17 @@ export async function registerClient(
         headers: {
             'Content-Type': 'application/json'
         },
-        body: JSON.stringify(submittedMetadata)
+        body: JSON.stringify(submittedMetadata),
+        // Registration responses are terminal (RFC 7591 §3.2): a redirect is not followed.
+        redirect: 'manual'
     });
 
+    if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400)) {
+        throw new Error(
+            `Registration endpoint responded with a redirect (HTTP ${response.status || 'filtered by the runtime'}); registration responses are terminal`
+        );
+    }
+
     if (!response.ok) {
         throw new RegistrationRejectedError({ status: response.status, body: await response.text(), submittedMetadata });
     }

packages/client/test/client/auth.test.ts

@@ -1965,6 +1965,50 @@ describe('OAuth Authorization', () => {
             expect(body.get('resource')).toBe('https://api.example.com/mcp-server');
         });
 
+        it('does not follow a token endpoint redirect and rejects', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: false,
+                status: 307,
+                headers: new Headers({ location: 'https://elsewhere.example.com/token' }),
+                text: async () => ''
+            });
+
+            await expect(
+                exchangeAuthorization('https://auth.example.com', {
+                    clientInformation: validClientInfo,
+                    authorizationCode: 'code123',
+                    codeVerifier: 'verifier123',
+                    redirectUri: 'http://localhost:3000/callback'
+                })
+            ).rejects.toThrow(/redirect/);
+
+            // The redirect target is never requested — a single POST was issued,
+            // with redirects disabled.
+            expect(mockFetch).toHaveBeenCalledTimes(1);
+            expect(mockFetch.mock.calls[0]![1]).toMatchObject({ method: 'POST', redirect: 'manual' });
+        });
+
+        it('rejects a token response the runtime filtered as an opaque redirect', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: false,
+                status: 0,
+                type: 'opaqueredirect',
+                headers: new Headers(),
+                text: async () => ''
+            });
+
+            await expect(
+                exchangeAuthorization('https://auth.example.com', {
+                    clientInformation: validClientInfo,
+                    authorizationCode: 'code123',
+                    codeVerifier: 'verifier123',
+                    redirectUri: 'http://localhost:3000/callback'
+                })
+            ).rejects.toThrow(/redirect/);
+
+            expect(mockFetch).toHaveBeenCalledTimes(1);
+        });
+
         it('allows for string "expires_in" values', async () => {
             mockFetch.mockResolvedValueOnce({
                 ok: true,
@@ -2330,6 +2374,26 @@ describe('OAuth Authorization', () => {
             });
         });
 
+        it('does not follow a registration endpoint redirect and rejects', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: false,
+                status: 307,
+                headers: new Headers({ location: 'https://elsewhere.example.com/register' }),
+                text: async () => ''
+            });
+
+            await expect(
+                registerClient('https://auth.example.com', {
+                    clientMetadata: validClientMetadata
+                })
+            ).rejects.toThrow(/redirect/);
+
+            // The redirect target is never requested — a single POST was issued,
+            // with redirects disabled.
+            expect(mockFetch).toHaveBeenCalledTimes(1);
+            expect(mockFetch.mock.calls[0]![1]).toMatchObject({ method: 'POST', redirect: 'manual' });
+        });
+
         it('includes scope in registration body when provided, overriding clientMetadata.scope', async () => {
             const clientMetadataWithScope: OAuthClientMetadata = {
                 ...validClientMetadata,