Skip to content

fix: preserve DCR client info on disconnect to avoid re-registration errors#1121

Open
peschee wants to merge 1 commit intomodelcontextprotocol:mainfrom
peschee:fix/oauth-dcr-preserve-client
Open

fix: preserve DCR client info on disconnect to avoid re-registration errors#1121
peschee wants to merge 1 commit intomodelcontextprotocol:mainfrom
peschee:fix/oauth-dcr-preserve-client

Conversation

@peschee
Copy link

@peschee peschee commented Feb 27, 2026

Summary

  • Bug: On disconnect/reconnect, the Inspector clears all OAuth session state including the dynamically registered client information (client_id, client_secret). However, the DCR-obtained client_id remains valid at the IDP, so discarding it forces an unnecessary re-registration that IDPs like Keycloak reject with a conflict error.
  • Root cause: clear() in auth.ts was wiping clientInformation from sessionStorage along with tokens and code verifier.
  • Fix: Stop clearing dynamically registered client information in clear(). Only tokens and transient OAuth state are cleared, preserving the still-valid DCR client credentials for reconnection.

Test plan

  • npm run build-client passes
  • cd client && npm run lint passes
  • Manual test: disconnect and reconnect to a Keycloak server — should reuse the existing DCR client without re-registration errors

…errors

Stop clearing dynamically registered client information from
sessionStorage in clear(). The DCR-obtained client_id remains valid
at the IDP, so discarding it on disconnect/reconnect forces an
unnecessary re-registration that IDPs like Keycloak reject.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant