Validates registered redirect_uris for DCR are a secure schema with no fragments - #3206

Closed

Varshith-Kali wants to merge 13 commits into

modelcontextprotocol:mainfrom

Varshith-Kali:fix/validate-redirect-uris

Commits on Aug 17, 2026

Validates registered redirect_uris for DCR are a secure schema with no fragments
Varshith-Kali
committed
91c532a
Fix circular import by moving validate_redirect_uri to url_validators module
Varshith-Kali
committed
f8a5c23
Fix BOM, CRLF line endings, and escaped quotes in url_validators
Varshith-Kali
committed
6861a77
Apply ruff formatting to test_routes.py
Varshith-Kali
committed
bd0e4d6
Only reject non-HTTP(S) schemes and fragments for redirect URIs
Varshith-Kali
committed
313376b
Fix ruff import sort in register.py
Varshith-Kali
committed
d4de8bc
Use pydantic AnyUrl instead of AnyHttpUrl for redirect URI validation
Varshith-Kali
committed
ec4bc48
Fix validate_issuer_url type hint from AnyHttpUrl to AnyUrl
Varshith-Kali
committed
27f86eb
fix: scope issuer loopback exception to http scheme only
Varshith-Kali
committed
6dce148
fix: remove UTF-8 BOM from url_validators.py
Varshith-Kali
committed
e89cbdb
fix(auth): drop duplicate validate_issuer_url and redundant redirect_uris guard
Varshith-Kali
committed
8e6c5fd
test(auth): cover invalid redirect_uri registration responses
Varshith-Kali
committed
f84551a
fix(auth): reject null redirect_uris in DCR registration
Varshith-Kali
committed
d99a7f3