[Client] Close the remaining OAuth and redirect gaps before 0.10.0 by chr-hertel · Pull Request #727 · modelcontextprotocol/php-sdk

[Client] Don't log a pending authorization as a transport error when a stream resumes

chr-hertel

committed

b69ca5d

[Client] Key stored tokens by grant and client, not only by issuer and resource

chr-hertel

committed

746940e

[Docs] Name the HTTP clients that follow redirects through PSR-18

chr-hertel

committed

e767e5d

[Client] Note in the changelog what a redirect exposed before 0.10.0

chr-hertel

committed

83b28c7

[Client] Refuse an authorization server or endpoint in a private network that a remote server names

chr-hertel

committed

466f892

[Client] Turn off redirects on a Symfony client passed to HttpTransport without auth

chr-hertel

committed

64878b2

[Client] Try the next metadata location when a document describes another resource

chr-hertel

committed

70e8690

[Client] Refresh a token before it expires instead of waiting for the server to reject it

chr-hertel

committed

c401957

[Client] Don't retry a request whose body can't tell or seek instead of throwing a stream error

chr-hertel

committed

0475224

[Client] Credit bbdu3 as author of the deferred authorization classes

chr-hertel

committed

61bbbcc

[Client] Keep the token when the storage fails during the refresh before sending

chr-hertel

committed

3f7b863

[Client] Seed the service account tests under the key the service account reads

chr-hertel

committed

9c70893

[Client] Keep the token when looking up its client fails during the refresh before sending

chr-hertel

committed

1fc8200

[Docs] Say that an expected issuer doesn't allow loopback or private endpoints of a public authorization server

chr-hertel

committed

f14f235

[Client] Record the client a token was issued to and never use a token of another

chr-hertel

committed

55fd0c1

[Client] Use the email address bbdu3 commits with in the author tags

chr-hertel

committed

b7a1379

[Client] Don't repeat a failed refresh before sending for the same token

chr-hertel

committed

b6362c9

[Docs] Say that the private network check looks at IP addresses, not at internal names

chr-hertel

committed

90cff68

[Client] Name the issuer checks of the endpoint validation

chr-hertel

committed

7810b72

[Client] Describe the token key correctly in the scope limit

chr-hertel

committed

51700a0

[Client] Refuse metadata for another resource in the discovery, instead of returning it to be refused

chr-hertel

committed

42454d3

[Server] Use the email address bbdu3 commits with in the author tags

chr-hertel

committed

79608ad

[Client] Also count NAT64, 6to4 and site-local addresses as a private network

chr-hertel

committed

92979d0

[Client] Don't refresh a token before sending that lives shorter than the leeway

chr-hertel

committed

b683845

Navigation Menu

Repository navigation

[Client] Close the remaining OAuth and redirect gaps before 0.10.0 - #727

[Client] Close the remaining OAuth and redirect gaps before 0.10.0#727
chr-hertel merged 24 commits into
modelcontextprotocol:mainfrom
chr-hertel:client-auth-before-tag

Commits on Nov 10, 2026

[Client] Don't log a pending authorization as a transport error when a stream resumes

[Client] Key stored tokens by grant and client, not only by issuer and resource

[Docs] Name the HTTP clients that follow redirects through PSR-18

[Client] Note in the changelog what a redirect exposed before 0.10.0

[Client] Refuse an authorization server or endpoint in a private network that a remote server names

[Client] Turn off redirects on a Symfony client passed to HttpTransport without auth

[Client] Try the next metadata location when a document describes another resource

[Client] Refresh a token before it expires instead of waiting for the server to reject it

[Client] Don't retry a request whose body can't tell or seek instead of throwing a stream error

[Client] Credit bbdu3 as author of the deferred authorization classes

[Client] Keep the token when the storage fails during the refresh before sending

[Client] Seed the service account tests under the key the service account reads

[Client] Keep the token when looking up its client fails during the refresh before sending

[Docs] Say that an expected issuer doesn't allow loopback or private endpoints of a public authorization server

[Client] Record the client a token was issued to and never use a token of another

[Client] Use the email address bbdu3 commits with in the author tags

[Client] Don't repeat a failed refresh before sending for the same token

[Docs] Say that the private network check looks at IP addresses, not at internal names

[Client] Name the issuer checks of the endpoint validation

[Client] Describe the token key correctly in the scope limit

[Client] Refuse metadata for another resource in the discovery, instead of returning it to be refused

[Server] Use the email address bbdu3 commits with in the author tags

[Client] Also count NAT64, 6to4 and site-local addresses as a private network

[Client] Don't refresh a token before sending that lives shorter than the leeway