ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-23 14:04:18 +02:00
Code Issues Projects Releases Packages Wiki Activity

Fix Chrome CSP blocking OAuth consent form with custom protocol redirects (#2305)

Browse source 
* Fix Chrome CSP blocking OAuth consent form with custom protocol redirects

* Fix Chrome CSP blocking OAuth consent form with custom protocol redirects

Dynamically include custom protocol schemes in CSP form-action directive
when redirect URIs use custom protocols like cursor://
This commit is contained in:
Jeremiah Lowin 2025-10-29 11:04:56 -07:00 • committed by GitHub
commit 463b336941
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/fastmcp/server/auth/oauth_proxy.py
View file

@ -365,7 +365,19 @@ def create_consent_html(
)
# Need to allow form-action for form submission
csp_policy = "default-src 'none'; style-src 'unsafe-inline'; img-src https:; base-uri 'none'; form-action *"
# Chrome requires explicit scheme declarations in CSP form-action when redirect chains
# end in custom protocol schemes (e.g., cursor://). Parse redirect_uri to include its scheme.
parsed_redirect = urlparse(redirect_uri)
redirect_scheme = parsed_redirect.scheme.lower()
# Build form-action directive with standard schemes plus custom protocol if present
form_action_schemes = ["https:", "http:"]
if redirect_scheme and redirect_scheme not in ("http", "https"):
# Custom protocol scheme (e.g., cursor:, vscode:, etc.)
form_action_schemes.append(f"{redirect_scheme}:")
form_action_directive = " ".join(form_action_schemes)
csp_policy = f"default-src 'none'; style-src 'unsafe-inline'; img-src https:; base-uri 'none'; form-action {form_action_directive}"
return create_page(
content=content,