Eric Traut 02360b48d1
Isolate MCP resource headers during OAuth requests ( #39019 ) ...
## Why
Headers configured for an MCP resource can contain credentials and must not be
forwarded to a different origin during OAuth discovery, registration, or token
exchange.
## What changed
- Apply configured resource headers only to OAuth requests on the MCP resource
origin, while allowing OAuth-generated headers to take precedence.
- Follow credentialed OAuth redirects only when each destination remains on the
resource origin. Preserve redirect method semantics, the overall timeout, the
response size limit, and a maximum of 10 redirects.
- Use the Codex MCP user agent for requests to authorization-server origins.
## Testing
Add coverage for cross-origin header isolation, same-origin dynamic client
registration redirects, OAuth header precedence, token refresh, timeout
accounting, and response size limits.
GitOrigin-RevId: 609d06e2b065e4aa9ca5382b4ae60455f9e26db9
2026-08-17 16:29:47 +00:00
2026-07-29 13:53:15 +00:00
2026-06-09 12:48:04 -07:00
2026-07-23 19:19:35 +00:00
2026-07-21 22:44:43 +00:00
2026-08-17 04:01:37 +00:00
2026-07-29 13:53:15 +00:00
2026-08-17 13:20:58 +00:00
2026-08-13 13:57:25 +00:00
2026-07-21 08:50:21 +00:00
2026-08-17 04:01:37 +00:00
2026-07-30 19:47:30 +00:00
2026-08-17 04:01:37 +00:00
2026-08-16 06:48:59 +00:00
2026-08-10 18:44:58 +00:00
2026-08-10 01:39:55 +00:00
2026-06-11 18:16:39 -07:00
2026-08-17 13:20:58 +00:00
2026-08-11 03:39:02 +00:00
2026-08-14 05:03:39 +00:00
2026-08-17 12:26:59 +00:00
2026-08-17 10:01:59 +00:00
2026-08-13 19:35:22 +00:00
2026-08-13 19:35:22 +00:00
2026-07-21 08:28:51 +00:00
2026-06-11 18:16:39 -07:00
2026-08-14 20:42:35 +00:00
2026-08-15 21:26:28 +00:00
2026-08-14 22:40:19 +00:00
2026-08-05 16:09:01 +00:00
2026-08-15 01:34:33 +00:00
2026-07-30 21:49:53 +00:00
2026-08-13 23:13:37 +00:00
2026-06-15 20:10:53 -07:00
2026-08-14 19:57:04 +00:00
2026-08-04 22:58:02 +00:00
2026-08-17 16:20:52 +00:00
2026-08-07 00:23:38 +00:00
2026-08-03 11:39:51 +00:00
2026-08-17 16:20:52 +00:00
2026-08-14 21:17:29 +00:00
2026-08-15 05:28:53 +00:00
2026-08-07 11:30:17 +00:00
2026-08-13 00:00:16 +00:00
2026-08-17 04:01:37 +00:00
2026-08-17 04:17:45 +00:00
2026-08-14 23:42:40 +00:00
2026-08-17 04:37:50 +00:00
2026-08-17 13:29:57 +00:00
2026-08-14 13:44:51 +00:00
2026-08-17 13:06:15 +00:00
2026-08-07 19:56:29 +00:00
2026-07-31 21:37:56 +00:00
2026-07-23 23:35:29 +00:00
2026-05-28 23:09:55 -07:00
2026-08-10 15:50:53 +00:00
2026-08-14 12:16:51 +00:00
2026-08-17 04:17:45 +00:00
2026-08-17 00:09:44 +00:00
2026-08-10 22:12:14 +00:00
2026-06-12 19:52:49 +00:00
2026-08-14 05:03:39 +00:00
2026-07-22 04:17:34 +00:00
2026-08-15 14:31:04 +00:00
2026-08-17 10:01:59 +00:00
2026-08-14 13:44:51 +00:00
2026-07-17 20:52:42 +00:00
2026-08-14 18:01:06 +00:00
2026-08-14 01:23:59 +00:00
2026-08-17 11:44:56 +00:00
2026-08-14 23:42:40 +00:00
2026-07-30 04:26:36 +00:00
2026-08-17 13:20:58 +00:00
2026-08-10 14:25:13 +00:00
2026-08-13 01:52:02 +00:00
2026-08-17 16:20:52 +00:00
2026-08-15 01:34:33 +00:00
2026-08-17 16:29:47 +00:00
2026-08-17 04:01:37 +00:00
2026-08-06 03:11:42 +00:00
2026-08-14 11:47:12 +00:00
2026-08-10 15:43:10 +00:00
2026-08-13 18:30:51 +00:00
2026-08-08 16:58:26 +00:00
2026-08-14 01:49:00 +00:00
2026-08-17 04:01:37 +00:00
2026-08-04 03:49:53 +00:00
2026-08-17 10:01:59 +00:00
2026-08-17 04:01:37 +00:00
2026-08-14 05:49:33 +00:00
2026-08-17 04:01:37 +00:00
2026-08-13 23:29:52 +00:00
2026-07-22 16:18:08 +00:00
2026-06-13 21:43:39 -07:00
2026-07-24 00:16:42 +00:00
2026-08-14 22:28:33 +00:00
2026-08-15 14:31:04 +00:00
2026-07-09 17:31:44 -07:00
2026-08-17 00:09:44 +00:00
2026-08-15 11:01:30 +00:00
2026-07-28 20:49:22 +00:00
2026-07-11 03:27:51 +00:00
2026-07-29 13:53:15 +00:00
2026-08-11 23:40:07 +00:00
2026-06-04 09:16:03 -07:00
Eric Traut
02360b48d1