From ff33b5a5c0b98783e07d98c4817dd27320d75fc2 Mon Sep 17 00:00:00 2001 From: Jakob Wennberg <149234542+jakobwennberg@users.noreply.github.com> Date: Sat, 21 Mar 2026 15:32:52 +0100 Subject: [PATCH] fix: exclude .well-known from auth middleware for MCP OAuth discovery (#76) The .well-known/oauth-protected-resource and oauth-authorization-server routes were caught by the auth middleware and redirected to /login, preventing Claude Desktop from discovering the OAuth endpoints. Co-authored-by: Claude Opus 4.6 (1M context) --- middleware.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/middleware.ts b/middleware.ts index 21ae0c2b..8f2903b8 100644 --- a/middleware.ts +++ b/middleware.ts @@ -15,6 +15,6 @@ export const config = { * - api (API routes - they handle their own auth) * - Static assets (images, scripts, manifest, icons, etc.) */ - '/((?!_next/static|_next/image|favicon.ico|api|sw\\.js|sw-register\\.js|manifest\\.json|icons/|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|js|json)$).*)', + '/((?!_next/static|_next/image|favicon.ico|api|\\.well-known|sw\\.js|sw-register\\.js|manifest\\.json|icons/|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|js|json)$).*)', ], }