René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"DCR registration accepts redirect_uris with non-HTTPS / non-loopback / fragmented schemes","articleBody":"## Summary\n\nThe DCR handler (`mcp.server.auth.handlers.register.RegistrationHandler.handle`) does not validate the scheme of submitted `redirect_uris`. A client registered via DCR can supply `javascript:`, `data:`, `vbscript:`, `file:`, `ftp:`, or cleartext `http://` (non-loopback) values, and they pass through to the provider's `register_client`. The SDK already enforces an HTTPS-or-loopback policy on the Issuer URL (`routes.validate_issuer_url`); the same policy is missing for registered `redirect_uris`. RFC 9700 §4.1.1 and RFC 7591 §2 require it.\n\n## Reproduction\n\nThe underlying field, `mcp.shared.auth.OAuthClientMetadata.redirect_uris` (`src/mcp/shared/auth.py:40`), is typed `list[AnyUrl] | None`. Pydantic's `AnyUrl` accepts any well-formed URL with a scheme. Verified on `main` at `161834d4ae`:\n\n```python\nfrom pydantic import AnyUrl, BaseModel, Field\nfrom typing import List\n\nclass M(BaseModel):\n    redirect_uris: List[AnyUrl] = Field(..., min_length=1)\n\nfor uri in [\n    \"javascript:alert(1)\",\n    \"data:text/html,\u003cscript\u003ealert(1)\u003c/script\u003e\",\n    \"file:///etc/passwd\",\n    \"vbscript:msgbox(1)\",\n    \"ftp://attacker.example/cb\",\n    \"http://attacker.example/cb\",\n    \"https://example.com/cb#frag\",\n    \"https://example.com/cb#\",\n]:\n    M(redirect_uris=[uri])  # all accepted, no ValidationError\n```\n\nAgainst a running MCP server with the default DCR handler, `POST /register` with any of the above values returns 201 and stores the URI. After registration, `OAuthClientMetadata.validate_redirect_uri` does exact-equality match against the registered list, so the bad URI is accepted as the authorization callback target.\n\n## Existing parallel logic to mirror\n\n`src/mcp/server/auth/routes.py:24–42` (`validate_issuer_url`):\n\n```python\nif url.scheme != \"https\" and url.host not in (\"localhost\", \"127.0.0.1\", \"[::1]\"):\n    raise ValueError(\"Issuer URL must be HTTPS\")\n\nif url.fragment:\n    raise ValueError(\"Issuer URL must not have a fragment\")\n```\n\n## Related\n\n- #1446 (closed as `duplicate`, no cross-reference recorded) — raised the same concern in question form.\n- #1934 (open) — fixes RFC 8252 §7.3 loopback port matching at authorize-time. Adjacent surface but orthogonal; does not add scheme validation at register-time.\n- TypeScript SDK PR `modelcontextprotocol/typescript-sdk#1738` covers the same authorize-time loopback gap on the TS side.\n\n## Proposed fix\n\nAdd `validate_registered_redirect_uri(url: AnyUrl) -\u003e None` next to `validate_issuer_url`:\n\n- Reject schemes other than `https`, or `http` with host in `{\"localhost\", \"127.0.0.1\", \"[::1]\"}`.\n- Reject URIs with a fragment (including empty fragments, e.g. `https://example.com/cb#` — note: this is also a latent bug in `validate_issuer_url`'s current `if url.fragment:` check, which I have NOT touched here to keep scope tight).\n- Permit query strings (RFC 7591 §2 explicitly allows them).\n\nCall it once per URI in `RegistrationHandler.handle` immediately after `model_validate_json` succeeds. On failure return `400 invalid_redirect_uri` per RFC 7591 §3.2.2.\n\nPR with the patch + tests: #\u003cPR_NUM_HERE\u003e.\n\n## Notes on severity\n\nBrowsers no longer navigate `javascript:` / `data:` schemes received in `Location` headers, which neutralises those vectors for browser-mediated flows. The realistic exploitable residue is (a) cleartext-HTTP redirect_uris to attacker-controlled hosts, and (b) custom-scheme deep links on devices where the MCP client uses a system handler. Defense-in-depth, not a critical exploit chain — happy to be downgraded if maintainers see it differently.\n","author":{"url":"https://github.com/CrypticCortex","@type":"Person","name":"CrypticCortex"},"datePublished":"2026-05-18T11:56:54.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/2629/python-sdk/issues/2629"}