Can not create proxy OAuth flow with google OAuth

[YashwantRamAB]

Describe the bug
Trying to create a Proxy OAuth flow with google OAuth but its failing with the invalid redirect uri error

To Reproduce
Steps to reproduce the behavior:

1. Redirects to /authorize
2. Throws invalid redirect uri error

Expected behavior
It should successfully authenticate

Logs
Response from /authorize

{
"error": "invalid_request",
"error_description": "Unregistered redirect_uri"
}

[wille]

The client object returned by clientsStore.getClient() must include the redirect_uri that google uses.

client = await provider.clientsStore.getClient(client_id);
if (!client) {
    throw new InvalidClientError('Invalid client_id');
}

if (redirect_uri !== undefined) {
    if (!client.redirect_uris.includes(redirect_uri)) {
      throw new InvalidRequestError('Unregistered redirect_uri');
    }
....

[YashwantRamAB]

The client object returned by clientsStore.getClient() must include the redirect_uri that google uses.

client = await provider.clientsStore.getClient(client_id);
if (!client) {
throw new InvalidClientError('Invalid client_id');
}

if (redirect_uri !== undefined) {
if (!client.redirect_uris.includes(redirect_uri)) {
throw new InvalidRequestError('Unregistered redirect_uri');
}
....

Below is my google redirect uri and the uri I am using in getClient. I am pretty sure I am configuring it properly, please correct me if I am wrong.

getClient: async (client_id) => {
    console.log(`Providing client credentials for client_id: ${client_id}`);

    return {
      client_id,
      client_secret: GOOGLE_CLIENT_SECRET,
      redirect_uris: ["http://localhost:8000/callback","http://localhost:8000/auth/callback"],
    };
  }

I think the redirect URI is not properly changing or being handled.

Below is the authorize URL and if you see the redirect uri is wrong. It's the ephemeral ports or vs code.

http://localhost:8000/authorize?client_id={client_id}&response_type=code&code_challenge=FjG97iVnOYpXWeniwfyPZh883-QMR9ja2bK0aRVglGQ&code_challenge_method=S256&scope=openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&resource=http%3A%2F%2Flocalhost%3A8000%2Fmcp&redirect_uri=http%3A%2F%2F127.0.0.1%3A33418%2F&state=4x%2FOXDggFGmsBpWlR%2B6TOg%3D%3D

[kym6464]

Hey @YashwantRamAB check out https://github.com/kym6464/mcp-server-remote

[felixweinberger]

Thanks for reporting! There isn't enough information here for us to reproduce the issue. Could you provide a minimal example we can run?

cc @pcarleton

[mcp-claude]

two-layer problem. the immediate error ("Unregistered redirect_uri") comes from authorize.ts rejecting the MCP client's ephemeral port URI — but even fixing that, ProxyOAuthServerProvider forwards the ephemeral URI to Google verbatim, which Google also rejects.

layer 1 — user config (workaround available): authorize.ts:115 checks redirectUriMatches(requested, registered) against client.redirect_uris. RFC 8252 §7.3 loopback relaxation only ignores the port — hostname and path must still match exactly. the reporter registered http://localhost:8000/callback in getClient, but the MCP client sends http://127.0.0.1:33418/ (127.0.0.1 ≠ localhost, / ≠ /callback). workaround: register http://127.0.0.1/ (no port) in getClient.redirect_uris so the ephemeral port matches.

layer 2 — proxy design gap (no workaround): even with the correct registered URI, ProxyOAuthServerProvider.authorize() (src/server/auth/providers/proxyProvider.ts:128) passes params.redirectUri — the ephemeral http://127.0.0.1:33418/ — directly as redirect_uri when redirecting to Google. Google requires an exact pre-registered URI and rejects it. a proper proxy must:

1. accept and store the MCP client's ephemeral redirect_uri
2. forward its own fixed callback URL to Google
3. on callback, look up the stored ephemeral URI and relay the code back to the MCP client

this substitution logic is entirely absent from ProxyOAuthServerProvider.

repro script + output

repro.ts (run from repo root on v1.x):

import { redirectUriMatches } from './src/server/auth/handlers/authorize.js';

const mcpClientRedirectUri = 'http://127.0.0.1:33418/';
const userRegisteredUris = ['http://localhost:8000/callback', 'http://localhost:8000/auth/callback'];

const matchesAny = userRegisteredUris.some(uri => redirectUriMatches(mcpClientRedirectUri, uri));
console.log(`SDK validation: ${matchesAny ? 'PASS' : 'FAIL — throws Unregistered redirect_uri'}`);

for (const reg of userRegisteredUris) {
  const req = new URL(mcpClientRedirectUri), regUrl = new URL(reg);
  console.log(`\n  redirectUriMatches("${mcpClientRedirectUri}", "${reg}") = ${redirectUriMatches(mcpClientRedirectUri, reg)}`);
  console.log(`    hostname: ${req.hostname} === ${regUrl.hostname} => ${req.hostname === regUrl.hostname}`);
  console.log(`    path: ${req.pathname} === ${regUrl.pathname} => ${req.pathname === regUrl.pathname}`);
}

console.log(`\nWith correct base URI: redirectUriMatches("${mcpClientRedirectUri}", "http://127.0.0.1/") = ${redirectUriMatches(mcpClientRedirectUri, 'http://127.0.0.1/')}`);

// Layer 2: show what the proxy actually sends to Google
const params = new URLSearchParams({ client_id: 'my-google-client-id', response_type: 'code',
  redirect_uri: mcpClientRedirectUri, code_challenge: 'abc123', code_challenge_method: 'S256' });
console.log('\nProxy forwards to Google:\nhttps://accounts.google.com/o/oauth2/v2/auth?' + params.toString());
console.log('\nGoogle rejects → { "error": "invalid_request", "error_description": "Unregistered redirect_uri" }');

command: npx tsx repro.ts

output:

SDK validation: FAIL — throws Unregistered redirect_uri

  redirectUriMatches("http://127.0.0.1:33418/", "http://localhost:8000/callback") = false
    hostname: 127.0.0.1 === localhost => false
    path: / === /callback => false

  redirectUriMatches("http://127.0.0.1:33418/", "http://localhost:8000/auth/callback") = false
    hostname: 127.0.0.1 === localhost => false
    path: / === /auth/callback => false

With correct base URI: redirectUriMatches("http://127.0.0.1:33418/", "http://127.0.0.1/") = true

Proxy forwards to Google:
https://accounts.google.com/o/oauth2/v2/auth?client_id=my-google-client-id&response_type=code&redirect_uri=http%3A%2F%2F127.0.0.1%3A33418%2F&code_challenge=abc123&code_challenge_method=S256

Google rejects → { "error": "invalid_request", "error_description": "Unregistered redirect_uri" }

code path: authorize.ts:115 → redirectUriMatches() fails for user's config. Even with a fixed config, proxyProvider.ts:128 (redirect_uri: params.redirectUri) passes the ephemeral URI to Google.

tested on v1.x (bf1e022). not present on main (b8886e7) — the v2 rewrite removed ProxyOAuthServerProvider entirely.