donghyeon.kang/cokaremote
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix OAuth approval redirect and generalize client copy

Browse Source
This commit is contained in:
root
2026-08-21 09:27:00 +00:00
parent 080030c764
commit c1fdde0d9f
2 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/oauth.ts
+5 -4
View File
@@ -438,7 +438,7 @@ function renderAuthorizationPage(
params: AuthorizationParams, params: AuthorizationParams,
invalidKey: boolean, invalidKey: boolean,
): string { ): string {
const clientName = client.client_name || "ChatGPT MCP client"; const clientName = client.client_name || "MCP 클라이언트";
let redirectHost = params.redirectUri; let redirectHost = params.redirectUri;
try { try {
redirectHost = new URL(params.redirectUri).host; redirectHost = new URL(params.redirectUri).host;
@@ -480,13 +480,13 @@ function renderAuthorizationPage(
<main> <main>
<h1>cokacremote 연결 승인</h1> <h1>cokacremote 연결 승인</h1>
<p><strong>${escapeHtml(clientName)}</strong>이 이 서버의 MCP 도구 사용 권한을 요청했습니다.</p> <p><strong>${escapeHtml(clientName)}</strong>이 이 서버의 MCP 도구 사용 권한을 요청했습니다.</p>
<p class="warning">승인하면 ChatGPT가 이 EC2에서 root 권한으로 명령 실행과 파일 변경을 수행할 수 있습니다.</p> <p class="warning">승인하면 연결된 MCP 클라이언트가 이 서버에서 root 권한으로 명령을 실행하고 파일을 변경할 수 있습니다.</p>
${invalidKey ? '<p class="error">인증키가 올바르지 않습니다.</p>' : ""} ${invalidKey ? '<p class="error">인증키가 올바르지 않습니다.</p>' : ""}
<form method="post" action="/authorize" autocomplete="off"> <form method="post" action="/authorize" autocomplete="off">
${fields} ${fields}
<label for="access_key">MCP 인증키</label> <label for="access_key">MCP 인증키</label>
<input id="access_key" name="access_key" type="password" required autofocus autocomplete="current-password"> <input id="access_key" name="access_key" type="password" required autofocus autocomplete="current-password">
<button type="submit">승인하고 ChatGPT로 돌아가기</button> <button type="submit">승인하고 MCP 클라이언트로 돌아가기</button>
</form> </form>
<small>콜백 대상: ${escapeHtml(redirectHost)} · 범위: ${escapeHtml(params.scopes?.join(" ") || OAUTH_SCOPES.join(" "))}</small> <small>콜백 대상: ${escapeHtml(redirectHost)} · 범위: ${escapeHtml(params.scopes?.join(" ") || OAUTH_SCOPES.join(" "))}</small>
</main> </main>
@@ -553,9 +553,10 @@ export class RemoteDevOAuthProvider implements OAuthServerProvider {
? request.body.access_key ? request.body.access_key
: undefined; : undefined;
const redirectOrigin = new URL(params.redirectUri).origin;
response.set({ response.set({
"Content-Security-Policy": "Content-Security-Policy":
"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'", `default-src 'none'; style-src 'unsafe-inline'; form-action 'self' ${redirectOrigin}; base-uri 'none'; frame-ancestors 'none'`,
"Referrer-Policy": "no-referrer", "Referrer-Policy": "no-referrer",
"X-Content-Type-Options": "nosniff", "X-Content-Type-Options": "nosniff",
}); });
test/oauth.integration.test.ts
+3 -1
View File
@@ -190,7 +190,9 @@ describe("OAuth 2.1 MCP authorization", () => {
redirect: "manual", redirect: "manual",
}); });
expect(loginPage.status).toBe(200); expect(loginPage.status).toBe(200);
expect(loginPage.headers.get("content-security-policy")).toContain("form-action 'self'"); expect(loginPage.headers.get("content-security-policy")).toContain(
"form-action 'self' https://chatgpt.com",
);
expect(await loginPage.text()).toContain("MCP 인증키"); expect(await loginPage.text()).toContain("MCP 인증키");
const rejectedLogin = await fetch(`${baseUrl}/authorize`, { const rejectedLogin = await fetch(`${baseUrl}/authorize`, {