fix(oauth): reject incompatible authorization code payloads by jah2488 · Pull Request #55 · netlify/netlify-mcp

jah2488 · 2026-10-01T18:05:45Z

Summary

Submitting an access or refresh token as an authorization code crashed /oauth-server/token while reading missing authorization state.
The endpoint now returns 400 invalid_grant for incompatible decrypted payloads.

How and why

Validate the token, state and scope before processing the exchange so malformed payloads cannot reach state lookups or scope parsing.
Valid authorization codes continue through the existing client, redirect and PKCE checks.

Testing

On a preview deployment, complete an OAuth flow, then submit its access token as code with grant_type=authorization_code, the same client_id and redirect_uri, and a code_verifier.
Expect 400 invalid_grant; repeat with the refresh token if the client requested offline_access.

netlify · 2026-10-01T18:05:53Z

✅ Deploy Preview for ntl-mcp ready!

Name	Link
🔨 Latest commit	`b5ae0f6`
🔍 Latest deploy log	https://app.netlify.com/projects/ntl-mcp/deploys/6af74566ccaaac9ad4874963
😎 Deploy Preview	https://deploy-preview-55--ntl-mcp.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-10-01T18:05:53Z

✅ Deploy Preview for netlify-mcp ready!

Name	Link
🔨 Latest commit	`b5ae0f6`
🔍 Latest deploy log	https://app.netlify.com/projects/netlify-mcp/deploys/6af74566524f2b81947730ff
😎 Deploy Preview	https://deploy-preview-55--netlify-mcp.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-10-01T18:05:53Z

✅ Deploy Preview for mcp ready!

Name	Link
🔨 Latest commit	`b5ae0f6`
🔍 Latest deploy log	https://app.netlify.com/projects/mcp/deploys/6af74566a43fdc6218cd5505
😎 Deploy Preview	https://deploy-preview-55--mcp.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

coderabbitai · 2026-10-01T18:05:53Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Last reviewed commit: adc3cba
Latest commit, not reviewed: b5ae0f6

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

Bug Fixes
- Authorization-code exchanges reject malformed payloads with an invalid_grant response instead of proceeding with invalid token data.
- Valid PKCE exchanges return the supplied access token and include a refresh token only when the requested scope includes offline_access.

The code-exchange handler now rejects decrypted payloads with invalid access-token, state, or scope fields using invalid_grant. Tests cover invalid payloads and valid PKCE exchanges, including access-token decryption and refresh-token issuance for the offline_access scope.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: seancdavis

Merge Risk: Minimal · previous review adc3c

The handler rejects incompatible authorization-code payloads while preserving valid exchanges with optional scope. No concrete merge-blocking issue is established.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: rejecting incompatible OAuth authorization code payloads.
Description check		The description directly explains the OAuth failure, the invalid_grant response, the validation changes, and the testing approach.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: `722c1bff-f626-4a51-ad96-46d51e9dba49`

📥 Commits

Reviewing files that changed from the base of the PR and between `f7f7f06` and `adc3cba`.

📒 Files selected for processing: 1

`netlify/functions/mcp-server/auth-flow.ts`

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

`netlify/blueprints` (manual)

Included review availability: This review used your included allowance. 8 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

pkg-pr-new · 2026-10-01T18:06:12Z

Open in StackBlitz

npm i https://pkg.pr.new/@netlify/mcp@55

commit: b5ae0f6

jah2488 · 2026-10-05T20:38:32Z

🤖🍼 Babysitter.pr 🍼🤖

Rebased onto main (19ed461, #83) with no conflicts and force-pushed with lease. auth-flow tests pass locally (13/13).

serhalp · 2026-10-13T22:13:17Z

+  if (typeof accessToken !== 'string' || !accessToken ||
+      !state || typeof state !== 'object' || Array.isArray(state) ||
+      (state.scope !== undefined && typeof state.scope !== 'string')) {


We already use zod in this codebase. Could we kill the as any and as any as CODE_JWE_PAYLOAD above and just use zod for this? We'd get better type safety and DX and this would just work exhaustively.

jah2488 marked this pull request as ready for review October 2, 2026 16:41

jah2488 force-pushed the justinherrick/reject-invalid-oauth-code branch 3 times, most recently from aecb1ad to f7f7f06 Compare October 5, 2026 19:37

serhalp reviewed Oct 13, 2026

View reviewed changes

jah2488 force-pushed the justinherrick/reject-invalid-oauth-code branch 3 times, most recently from 28c5771 to d89b2e0 Compare October 20, 2026 18:56

jah2488 force-pushed the justinherrick/reject-invalid-oauth-code branch 4 times, most recently from b186081 to 9fe08e6 Compare October 26, 2026 16:11

jah2488 force-pushed the justinherrick/reject-invalid-oauth-code branch 4 times, most recently from eb610c2 to 6da541c Compare November 3, 2026 19:39

jah2488 force-pushed the justinherrick/reject-invalid-oauth-code branch from 6da541c to ed37422 Compare November 13, 2026 14:11

fix(oauth): reject incompatible authorization code payloads

b5ae0f6

jah2488 force-pushed the justinherrick/reject-invalid-oauth-code branch from ed37422 to b5ae0f6 Compare November 13, 2026 17:14

Navigation Menu

Repository navigation

fix(oauth): reject incompatible authorization code payloads - #55

fix(oauth): reject incompatible authorization code payloads#55
jah2488 wants to merge 1 commit into
mainfrom
justinherrick/reject-invalid-oauth-code

jah2488 commented Oct 1, 2026

Uh oh!

netlify Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

Reviews paused

Summary by CodeRabbit

Uh oh!

pkg-pr-new Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

jah2488 commented Oct 5, 2026 •

edited

Loading

Uh oh!

serhalp Oct 13, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jah2488 commented Oct 1, 2026

Summary

How and why

Testing

Uh oh!

netlify Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for ntl-mcp ready!

Uh oh!

netlify Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for netlify-mcp ready!

Uh oh!

netlify Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for mcp ready!

Uh oh!

coderabbitai Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Summary by CodeRabbit

Uh oh!

pkg-pr-new Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jah2488 commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

serhalp Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify Bot commented Oct 1, 2026 •

edited

Loading

netlify Bot commented Oct 1, 2026 •

edited

Loading

netlify Bot commented Oct 1, 2026 •

edited

Loading

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

pkg-pr-new Bot commented Oct 1, 2026 •

edited

Loading

jah2488 commented Oct 5, 2026 •

edited

Loading