From 51467717f1e94068b300606ce4c433c9b0ff61e5 Mon Sep 17 00:00:00 2001 From: Jakob Wennberg <149234542+jakobwennberg@users.noreply.github.com> Date: Sat, 21 Mar 2026 15:52:00 +0100 Subject: [PATCH] fix: broaden OAuth redirect_uri allowlist for Claude Desktop (#77) * fix: broaden OAuth redirect_uri allowlist for Claude Desktop Claude Desktop uses varying callback paths (with org/connector IDs), not a single fixed callback URL. Allow any path under claude.ai and claude.com instead of requiring an exact match. Co-Authored-By: Claude Opus 4.6 (1M context) * fix: tighten redirect_uri allowlist to /api/ prefix only Co-Authored-By: Claude Opus 4.6 (1M context) --------- Co-authored-by: Claude Opus 4.6 (1M context) --- app/api/mcp-oauth/authorize/route.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/app/api/mcp-oauth/authorize/route.ts b/app/api/mcp-oauth/authorize/route.ts index 70c7da49..2474bf60 100644 --- a/app/api/mcp-oauth/authorize/route.ts +++ b/app/api/mcp-oauth/authorize/route.ts @@ -12,10 +12,10 @@ import { createAuthCode } from '@/lib/auth/oauth-codes' * after PKCE verification, preventing orphaned keys on abandoned flows. */ -// Known Claude callback URLs — reject all others to prevent open redirect +// Allowed redirect URI patterns — prevent open redirect attacks const ALLOWED_REDIRECT_PATTERNS = [ - /^https:\/\/claude\.ai\/api\/mcp\/auth_callback$/, - /^https:\/\/claude\.com\/api\/mcp\/auth_callback$/, + /^https:\/\/claude\.ai\/api\//, // Claude.ai API callbacks (connector IDs vary in path) + /^https:\/\/claude\.com\/api\//, // Claude.com API callbacks /^http:\/\/localhost(:\d+)?\//, // Local development /^http:\/\/127\.0\.0\.1(:\d+)?\//, // Local development ]