fix(auth): preserve state parameter on error redirects (RFC 6749 §4.1.2.1)

[insuffer]

Problem

Per RFC 6749 §4.1.2.1, when an authorization request includes a state parameter and the server redirects back with an error, the redirect MUST echo the state so the client can correlate the response (CSRF protection).

In authorize.ts, Phase 2 assigns state only after RequestAuthorizationParamsSchema.safeParse succeeds:

let state;
try {
    const parseResult = RequestAuthorizationParamsSchema.safeParse(...);
    if (!parseResult.success) {
        throw new InvalidRequestError(parseResult.error.message); // state still undefined
    }
    state = parseResult.data.state;

So any parameter failing schema validation (e.g. missing code_challenge, unsupported code_challenge_method) produces an error redirect that silently drops the client's state. Reported in #2773.

Fix

Recover state from the raw request params (only when it is a string) before throwing on parse failure, so error redirects carry it as required. Successful-path behavior is unchanged.

Tests

Two regression tests (GET and POST): valid client_id/redirect_uri + state + a param that fails RequestAuthorizationParamsSchema → expect 302 Location containing both error=invalid_request and state. Both fail on v1.x before the fix.

• test/server/auth/handlers/authorize.test.ts: 29/29 pass
• Full suite (npm test, e2e excluded): 1649/1649 pass — the 2 unhandled stdio-serialization errors are pre-existing on a pristine v1.x checkout (verified via stash, unrelated to this change)
• npm run typecheck, eslint and prettier all clean

Closes #2773

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8abdaaf

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@modelcontextprotocol/sdk@2842

commit: 8abdaaf