Eric Traut 02360b48d1 Isolate MCP resource headers during OAuth requests (#39019) ...

## Why

Headers configured for an MCP resource can contain credentials and must not be
forwarded to a different origin during OAuth discovery, registration, or token
exchange.

## What changed

- Apply configured resource headers only to OAuth requests on the MCP resource
  origin, while allowing OAuth-generated headers to take precedence.
- Follow credentialed OAuth redirects only when each destination remains on the
  resource origin. Preserve redirect method semantics, the overall timeout, the
  response size limit, and a maximum of 10 redirects.
- Use the Codex MCP user agent for requests to authorization-server origins.

## Testing

Add coverage for cross-origin header isolation, same-origin dynamic client
registration redirects, OAuth header precedence, token refresh, timeout
accounting, and response size limits.

GitOrigin-RevId: 609d06e2b065e4aa9ca5382b4ae60455f9e26db9

2026-08-17 16:29:47 +00:00

..

src

Isolate MCP resource headers during OAuth requests (#39019)

2026-08-17 16:29:47 +00:00

tests

Isolate MCP resource headers during OAuth requests (#39019)

2026-08-17 16:29:47 +00:00

BUILD.bazel

[3/4] Add executor-backed RMCP HTTP client (#18583)

2026-04-22 17:38:04 -07:00

Cargo.toml

Propagate custom CA settings to local MCP servers (#38040)

2026-08-11 17:24:04 +00:00