jif 7f9832d0d0 Enforce issuer binding for MCP OAuth endpoints (#39935) ...

## Why

Interactive MCP OAuth must not trust authorization metadata that could route an
authorization code or PKCE verifier to an unrelated token endpoint.

## What changed

- Require an advertised issuer to match the origin that served authorization
  metadata.
- Validate authorization and token endpoint origins before starting both
  pre-registered and dynamically registered client flows.
- Allow delegated endpoint origins when the server advertises issuer-bound
  authorization responses, while retaining narrow compatibility exceptions for
  existing providers.

## Testing

Add coverage for rejected untrusted metadata, accepted issuer-bound delegation,
legacy provider exceptions, and both client registration paths.

GitOrigin-RevId: 43c9f94c9f6ba2d23d7e373576cf9fa26861cfc3

2026-08-21 13:28:28 +00:00

..

src

Enforce issuer binding for MCP OAuth endpoints (#39935)

2026-08-21 13:28:28 +00:00

tests

Enforce issuer binding for MCP OAuth endpoints (#39935)

2026-08-21 13:28:28 +00:00

BUILD.bazel

[3/4] Add executor-backed RMCP HTTP client (#18583)

2026-04-22 17:38:04 -07:00

Cargo.toml

Harden MCP OAuth fallback credential writes (#39611)

2026-08-20 06:17:48 +00:00