Add nonce validation#770
Closed
Glitched wants to merge 3 commits intomodelcontextprotocol:mainfrom
Closed
Conversation
- Add optional nonce parameter to client startAuthorization() - Auto-generate nonce when scope includes 'openid' - Pass nonce through server authorization handler - Update AuthorizationParams type to include nonce - Add comprehensive tests for nonce handling This enables proper OpenID Connect security by preventing replay attacks on ID tokens.
- Add afterEach to restore all mocks - Remove unnecessary mockClear() calls - Ensures tests are properly isolated
Implements proper nonce validation to prevent replay attacks when using OpenID Connect (scope includes 'openid'). Also adds audience validation for additional security. - Automatically generates nonce for OIDC flows - Validates nonce in ID tokens during token exchange - Validates audience (aud) claim matches client_id - Adds optional saveNonce/nonce methods to provider interface - Uses inline JWT decoder for better compatibility - Includes comprehensive test coverage Note: startAuthorization() now returns an optional nonce field when scope includes 'openid'. This is backward compatible for JavaScript users but may require TypeScript users to update explicit type annotations. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
felixweinberger
force-pushed
the
main
branch
from
0845a57 to
c94ba4b
Compare
This was referenced Mar 23, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add nonce validation for OpenID Connect flows to prevent replay attacks and improve OIDC compliance.
Motivation and Context
The SDK was generating and passing nonce parameters for OpenID Connect flows but wasn't validating them in ID tokens. This left the implementation vulnerable to replay attacks where an attacker could reuse intercepted ID tokens. This change completes the OIDC security model by validating that the nonce in the ID token matches what the client generated.
Additionally adds audience validation to ensure ID tokens are intended for our client.
How Has This Been Tested?
Added unit tests
Breaking Changes
TypeScript users only: The return type of startAuthorization() changed from { authorizationUrl: URL; codeVerifier: string } to { authorizationUrl: URL; codeVerifier: string; nonce?: string }. JavaScript users are unaffected.
OAuth provider implementations should add the optional saveNonce and nonce methods to support OpenID Connect flows, but these are optional and backward compatible.
Types of changes
Checklist
Additional context