Skip to content

fix: revoke OAuth tokens independently so one failure does not skip the other #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Ashutosh0x wants to merge 1 commit into from
+13 −6
Closed

fix: revoke OAuth tokens independently so one failure does not skip the other #67

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 13 additions & 6 deletions packages/mcp-shared/src/account.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -831,15 +831,22 @@ export abstract class McpAccountBase<E extends AccountEnv, P = unknown>
const discovery = this.ctx.storage.kv.get<OAuthDiscoveryState>("oauthDiscovery");
const client = this.ctx.storage.kv.get<StoredOAuthClientInformation>("oauthClient");
if (tokens && discovery && client) {
// Best effort: a server that does not implement RFC 7009 must not block the disconnect.
try {
const fetchFn = sdkFetch(this.fetchOptions());
await revokeToken(discovery, client, tokens.access_token, "access_token", fetchFn);
if (tokens.refresh_token) {
// Best effort per token: a server that refuses one token type (RFC 7009 §2.2.1) must not
// cost the revocation of the other. Refresh token first: RFC 7009 §2.1 says revoking it
// SHOULD also invalidate access tokens issued under the same grant.
const fetchFn = sdkFetch(this.fetchOptions());
if (tokens.refresh_token) {
try {
await revokeToken(discovery, client, tokens.refresh_token, "refresh_token", fetchFn);
} catch (err) {
this.log().warn("failed to revoke MCP refresh token",
{ event: "oauth.token.revoke.failed", error: err });
}
}
try {
await revokeToken(discovery, client, tokens.access_token, "access_token", fetchFn);
} catch (err) {
this.log().warn("failed to revoke MCP tokens",
this.log().warn("failed to revoke MCP access token",
{ event: "oauth.token.revoke.failed", error: err });
}
}
Expand Down
Loading