Treat redirected cross-app token responses as terminal

Author: felixweinberger

.changeset/token-registration-redirects-terminal.md

@@ -2,4 +2,4 @@
 '@modelcontextprotocol/client': patch
 ---
 
-Token and client registration requests no longer follow HTTP redirects. Token responses are terminal (RFC 6749 §5), so a 3xx answer from the token or registration endpoint now rejects with an error instead of being re-sent to the redirect target.
+Token and client registration requests no longer follow HTTP redirects — including the cross-app access token exchanges. Token responses are terminal (RFC 6749 §5), so a 3xx answer from a token or registration endpoint now rejects with an error instead of being re-sent to the redirect target.

docs/migration/upgrade-to-v2.md

@@ -1170,7 +1170,8 @@ OAuth `onUnauthorized` behavior, for composing your own adapter).
   sets the new `oauthRequestInit` transport option.
 - **Token and registration endpoint redirects are not followed.** The token-exchange
   and client-registration POSTs (`exchangeAuthorization()` / `refreshAuthorization()` /
-  `fetchToken()` / `registerClient()`, transitively `auth()`) are issued with
+  `fetchToken()` / `registerClient()`, transitively `auth()`, and the cross-app access
+  token exchanges `requestJwtAuthorizationGrant()` / `exchangeJwtAuthGrant()`) are issued with
   `redirect: 'manual'`; a 3xx answer rejects with an error instead of re-sending the
   request to the redirect target. Token responses are terminal (RFC 6749 §5) — an
   authorization server that redirects these requests must be addressed at its final

packages/client/src/client/crossAppAccess.ts

@@ -152,9 +152,16 @@ export async function requestJwtAuthorizationGrant(options: RequestJwtAuthGrantO
         headers: {
             'Content-Type': 'application/x-www-form-urlencoded'
         },
-        body: params.toString()
+        body: params.toString(),
+        redirect: 'manual'
     });
 
+    if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400)) {
+        throw new Error(
+            `Token endpoint responded with a redirect (HTTP ${response.status || 'filtered by the runtime'}); token responses are terminal`
+        );
+    }
+
     if (!response.ok) {
         const errorBody = await response.json().catch(() => ({}));
 
@@ -279,9 +286,16 @@ export async function exchangeJwtAuthGrant(options: {
     const response = await fetchFn(tokenUrl, {
         method: 'POST',
         headers,
-        body: params.toString()
+        body: params.toString(),
+        redirect: 'manual'
     });
 
+    if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400)) {
+        throw new Error(
+            `Token endpoint responded with a redirect (HTTP ${response.status || 'filtered by the runtime'}); token responses are terminal`
+        );
+    }
+
     if (!response.ok) {
         const errorBody = await response.json().catch(() => ({}));
 

packages/client/test/client/crossAppAccess.test.ts

@@ -22,6 +22,48 @@ describe('crossAppAccess', () => {
             expect(mockFetch).not.toHaveBeenCalled();
         });
 
+        it('does not follow a token endpoint redirect and rejects', async () => {
+            const mockFetch = vi.fn<FetchLike>().mockResolvedValue({
+                ok: false,
+                status: 307,
+                headers: new Headers({ location: 'https://elsewhere.example.com/token' }),
+                json: async () => ({})
+            } as Response);
+            await expect(
+                requestJwtAuthorizationGrant({
+                    tokenEndpoint: 'https://idp.example.com/token',
+                    audience: 'https://auth.chat.example/',
+                    resource: 'https://mcp.chat.example/',
+                    idToken: 'id-token',
+                    clientId: 'client',
+                    clientSecret: 'secret',
+                    fetchFn: mockFetch
+                })
+            ).rejects.toThrow(/redirect/);
+            expect(mockFetch).toHaveBeenCalledTimes(1);
+            expect(mockFetch.mock.calls[0]?.[1]?.redirect).toBe('manual');
+        });
+
+        it('rejects a token response the runtime filtered as an opaque redirect', async () => {
+            const mockFetch = vi.fn<FetchLike>().mockResolvedValue({
+                ok: false,
+                status: 0,
+                type: 'opaqueredirect',
+                headers: new Headers(),
+                json: async () => ({})
+            } as Response);
+            await expect(
+                exchangeJwtAuthGrant({
+                    tokenEndpoint: 'https://auth.chat.example/token',
+                    jwtAuthGrant: 'jag',
+                    clientId: 'client',
+                    clientSecret: 'secret',
+                    fetchFn: mockFetch
+                })
+            ).rejects.toThrow(/redirect/);
+            expect(mockFetch).toHaveBeenCalledTimes(1);
+        });
+
         it('permits a loopback http token endpoint (SEP-2207 exemption)', async () => {
             const mockFetch = vi.fn<FetchLike>().mockResolvedValue({
                 ok: true,