Skip to content

Commit 13f80d6

Browse files
jsandfordhughescooptaylorotwellnunomaduro
authored
Feature: adds security to the OAuth registration endpoint (#87)
* feat: adds security to the oauth registration endpoint * formatting * Update OAuthRegisterController.php * fix lint issueS * chore: types changes * chore: revert coverage up --------- Co-authored-by: Taylor Otwell <taylor@laravel.com> Co-authored-by: Nuno Maduro <enunomaduro@gmail.com>
1 parent b070a2e commit 13f80d6

File tree

5 files changed

+177
-25
lines changed

5 files changed

+177
-25
lines changed

‎config/mcp.php‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?php
2+
3+
return [
4+
5+
/*
6+
|--------------------------------------------------------------------------
7+
| Redirect Domains
8+
|--------------------------------------------------------------------------
9+
|
10+
| These domains are the domains that OAuth clients are permitted to use
11+
| for redirect URIs. Each domain should be specified with its scheme
12+
| and host. Domains not in this list will raise validation errors.
13+
|
14+
| An "*" may be used to allow all domains.
15+
|
16+
*/
17+
18+
'redirect_domains' => [
19+
'*',
20+
// 'https://example.com',
21+
],
22+
23+
];

‎src/Server/Http/Controllers/OAuthRegisterController.php‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace Laravel\Mcp\Server\Http\Controllers;
6+
7+
use Illuminate\Container\Container;
8+
use Illuminate\Contracts\Container\BindingResolutionException;
9+
use Illuminate\Http\JsonResponse;
10+
use Illuminate\Http\Request;
11+
use Illuminate\Support\Str;
12+
13+
class OAuthRegisterController
14+
{
15+
/**
16+
* Register a new OAuth client for a third-party application.
17+
*
18+
* @throws BindingResolutionException
19+
*/
20+
public function __invoke(Request $request): JsonResponse
21+
{
22+
$validated = $request->validate([
23+
'redirect_uris' => ['required', 'array', 'min:1'],
24+
'redirect_uris.*' => ['required', 'url', function (string $attribute, $value, $fail): void {
25+
if (in_array('*', config('mcp.redirect_domains', []), true)) {
26+
return;
27+
}
28+
29+
if (! Str::startsWith($value, $this->allowedDomains())) {
30+
$fail($attribute.' is not a permitted redirect domain.');
31+
}
32+
}],
33+
]);
34+
35+
$clients = Container::getInstance()->make(
36+
"Laravel\Passport\ClientRepository"
37+
);
38+
39+
$client = $clients->createAuthorizationCodeGrantClient(
40+
name: $request->get('name'),
41+
redirectUris: $validated['redirect_uris'],
42+
confidential: false,
43+
user: null,
44+
enableDeviceFlow: false,
45+
);
46+
47+
return response()->json([
48+
'client_id' => (string) $client->id,
49+
'grant_types' => $client->grantTypes,
50+
'response_types' => ['code'],
51+
'redirect_uris' => $client->redirectUris,
52+
'scope' => 'mcp:use',
53+
'token_endpoint_auth_method' => 'none',
54+
]);
55+
}
56+
57+
/**
58+
* Get the allowed redirect domains.
59+
*
60+
* @return array<int, string>
61+
*/
62+
protected function allowedDomains(): array
63+
{
64+
/** @var array<int, string> */
65+
$allowedDomains = config('mcp.redirect_domains', []);
66+
67+
return collect($allowedDomains)
68+
->map(fn (string $domain): string => Str::endsWith($domain, '/')
69+
? $domain
70+
: "{$domain}/"
71+
)
72+
->all();
73+
}
74+
}

‎src/Server/McpServiceProvider.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ class McpServiceProvider extends ServiceProvider
1919
public function register(): void
2020
{
2121
$this->app->singleton(Registrar::class, fn (): Registrar => new Registrar);
22+
23+
$this->mergeConfigFrom(__DIR__.'/../../config/mcp.php', 'mcp');
2224
}
2325

2426
public function boot(): void
@@ -48,6 +50,10 @@ protected function registerPublishing(): void
4850
__DIR__.'/../../stubs/server.stub' => base_path('stubs/server.stub'),
4951
__DIR__.'/../../stubs/tool.stub' => base_path('stubs/tool.stub'),
5052
], 'mcp-stubs');
53+
54+
$this->publishes([
55+
__DIR__.'/../../config/mcp.php' => config_path('mcp.php'),
56+
], 'mcp-config');
5157
}
5258

5359
protected function registerRoutes(): void

‎src/Server/Registrar.php‎

Lines changed: 2 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@
55
namespace Laravel\Mcp\Server;
66

77
use Illuminate\Container\Container;
8-
use Illuminate\Http\Request;
98
use Illuminate\Routing\Route;
109
use Illuminate\Support\Facades\Route as Router;
1110
use Illuminate\Support\Str;
1211
use Laravel\Mcp\Server;
1312
use Laravel\Mcp\Server\Contracts\Transport;
13+
use Laravel\Mcp\Server\Http\Controllers\OAuthRegisterController;
1414
use Laravel\Mcp\Server\Middleware\AddWwwAuthenticateHeader;
1515
use Laravel\Mcp\Server\Middleware\ReorderJsonAccept;
1616
use Laravel\Mcp\Server\Transport\HttpTransport;
@@ -102,30 +102,7 @@ public function oauthRoutes(string $oauthPrefix = 'oauth'): void
102102
'grant_types_supported' => ['authorization_code', 'refresh_token'],
103103
]))->name('mcp.oauth.authorization-server');
104104

105-
Router::post($oauthPrefix.'/register', function (Request $request) {
106-
$clients = Container::getInstance()->make(
107-
"Laravel\Passport\ClientRepository"
108-
);
109-
110-
$payload = $request->json()->all();
111-
112-
$client = $clients->createAuthorizationCodeGrantClient(
113-
name: $payload['client_name'],
114-
redirectUris: $payload['redirect_uris'],
115-
confidential: false,
116-
user: null,
117-
enableDeviceFlow: false,
118-
);
119-
120-
return response()->json([
121-
'client_id' => (string) $client->id,
122-
'grant_types' => $client->grantTypes,
123-
'response_types' => ['code'],
124-
'redirect_uris' => $client->redirectUris,
125-
'scope' => 'mcp:use',
126-
'token_endpoint_auth_method' => 'none',
127-
]);
128-
});
105+
Router::post($oauthPrefix.'/register', OAuthRegisterController::class);
129106
}
130107

131108
/**

‎tests/Unit/Server/RegistrarTest.php‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,3 +197,75 @@ public function createAuthorizationCodeGrantClient($name, $redirectUris, $confid
197197
'token_endpoint_auth_method' => 'none',
198198
]);
199199
});
200+
201+
it('handles oauth registration with allowed domains', function (): void {
202+
if (! class_exists('Laravel\Passport\ClientRepository')) {
203+
// Create a mock ClientRepository class for testing
204+
eval('
205+
namespace Laravel\Passport;
206+
class ClientRepository {
207+
public function createAuthorizationCodeGrantClient($name, $redirectUris, $confidential, $user, $enableDeviceFlow) {
208+
return (object) [
209+
"id" => "test-client-id",
210+
"grantTypes" => ["authorization_code"],
211+
"redirectUris" => $redirectUris,
212+
];
213+
}
214+
}
215+
');
216+
}
217+
218+
$registrar = new Registrar;
219+
$registrar->oauthRoutes();
220+
221+
config()->set('mcp.redirect_domains', ['http://localhost:3000/']);
222+
223+
$this->app->instance('Laravel\Passport\ClientRepository', new \Laravel\Passport\ClientRepository);
224+
225+
$response = $this->postJson('/oauth/register', [
226+
'client_name' => 'Test Client',
227+
'redirect_uris' => ['http://localhost:3000/callback'],
228+
]);
229+
230+
$response->assertStatus(200);
231+
$response->assertJson([
232+
'client_id' => 'test-client-id',
233+
'grant_types' => ['authorization_code'],
234+
'response_types' => ['code'],
235+
'redirect_uris' => ['http://localhost:3000/callback'],
236+
'scope' => 'mcp:use',
237+
'token_endpoint_auth_method' => 'none',
238+
]);
239+
});
240+
241+
it('handles oauth registration with incorrect redirect domain', function (): void {
242+
if (! class_exists('Laravel\Passport\ClientRepository')) {
243+
// Create a mock ClientRepository class for testing
244+
eval('
245+
namespace Laravel\Passport;
246+
class ClientRepository {
247+
public function createAuthorizationCodeGrantClient($name, $redirectUris, $confidential, $user, $enableDeviceFlow) {
248+
return (object) [
249+
"id" => "test-client-id",
250+
"grantTypes" => ["authorization_code"],
251+
"redirectUris" => $redirectUris,
252+
];
253+
}
254+
}
255+
');
256+
}
257+
258+
$registrar = new Registrar;
259+
$registrar->oauthRoutes();
260+
261+
config()->set('mcp.redirect_domains', ['http://allowed-domain.com/']);
262+
263+
$this->app->instance('Laravel\Passport\ClientRepository', new \Laravel\Passport\ClientRepository);
264+
265+
$response = $this->postJson('/oauth/register', [
266+
'client_name' => 'Test Client',
267+
'redirect_uris' => ['http://not-allowed.com/callback'],
268+
]);
269+
270+
$response->assertStatus(422);
271+
});

0 commit comments

Comments
 (0)