Block unsafe OAuth redirect schemes (#4419)

Author: jlowin

docs/servers/auth/oauth-proxy.mdx

@@ -194,7 +194,8 @@ mcp = FastMCP(name="My Server", auth=auth)
   List of allowed redirect URI patterns for MCP clients. Patterns support
   wildcards (e.g., `"http://localhost:*"`, `"https://*.example.com/*"`).
   - `None` (default): DCR clients use registered redirect URIs, with loopback
-    ports allowed to vary for MCP compatibility
+    ports allowed to vary for MCP compatibility. Unsafe browser schemes such as
+    `javascript:`, `data:`, `file:`, and `vbscript:` are rejected.
   - Empty list `[]`: No redirect URIs allowed
   - Custom list: Only matching patterns allowed
 
@@ -559,7 +560,7 @@ auth = OAuthProxy(
 
 ### Redirect URI Validation
 
-By default, the OAuth proxy validates DCR clients against their registered redirect URIs while allowing loopback ports to vary for MCP compatibility. You can restrict which clients can connect at the server level by specifying allowed patterns:
+By default, the OAuth proxy validates DCR clients against their registered redirect URIs while allowing loopback ports to vary for MCP compatibility. Unsafe browser schemes such as `javascript:` are always rejected. You can restrict which clients can connect at the server level by specifying allowed patterns:
 
 ```python
 # Allow only localhost clients (common for development)

docs/servers/auth/oidc-proxy.mdx

@@ -124,7 +124,7 @@ mcp = FastMCP(name="My Server", auth=auth)
 
 <ParamField body="allowed_client_redirect_uris" type="list[str] | None">
   List of allowed redirect URI patterns for MCP clients. Patterns support wildcards (e.g., `"http://localhost:*"`, `"https://*.example.com/*"`).
-  - `None` (default): DCR clients use registered redirect URIs, with loopback ports allowed to vary for MCP compatibility
+  - `None` (default): DCR clients use registered redirect URIs, with loopback ports allowed to vary for MCP compatibility. Unsafe browser schemes such as `javascript:`, `data:`, `file:`, and `vbscript:` are rejected.
   - Empty list `[]`: No redirect URIs allowed
   - Custom list: Only matching patterns allowed
 

docs/servers/auth/remote-oauth.mdx

@@ -116,7 +116,7 @@ auth = RemoteAuthProvider(
     token_verifier=token_verifier,
     authorization_servers=[AnyHttpUrl("https://auth.yourcompany.com")],
     base_url="https://api.yourcompany.com",  # Your server base URL
-    # Optional: restrict allowed client redirect URIs (defaults to all for DCR compatibility)
+    # Optional: restrict allowed client redirect URIs
     allowed_client_redirect_uris=["http://localhost:*", "http://127.0.0.1:*"]
 )
 
@@ -218,7 +218,7 @@ WorkOS's support for Dynamic Client Registration makes it particularly well-suit
 <Note>
 `RemoteAuthProvider` also supports the `allowed_client_redirect_uris` parameter for controlling which redirect URIs are accepted from MCP clients during DCR:
 
-- `None` (default): All redirect URIs allowed (for DCR compatibility)
+- `None` (default): Broad DCR-compatible redirect support, while rejecting unsafe browser schemes such as `javascript:`, `data:`, `file:`, and `vbscript:`
 - Custom list: Specify allowed patterns with wildcard support
 - Empty list `[]`: No redirect URIs allowed
 
@@ -237,4 +237,4 @@ Remote OAuth integration requires careful attention to several technical details
 
 **Scope Management**: Map token scopes to your application's permission model consistently. Consider how scope changes affect existing tokens and plan for smooth permission updates.
 
-The complexity of these considerations reinforces why external identity providers are recommended over custom OAuth implementations. Established providers handle these technical details with extensive testing and operational experience.
+The complexity of these considerations reinforces why external identity providers are recommended over custom OAuth implementations. Established providers handle these technical details with extensive testing and operational experience.

fastmcp_slim/fastmcp/server/auth/oauth_proxy/consent.py

@@ -23,6 +23,7 @@
 
 from fastmcp.server.auth.oauth_proxy.models import ProxyDCRClient
 from fastmcp.server.auth.oauth_proxy.ui import create_consent_html
+from fastmcp.server.auth.redirect_validation import validate_redirect_uri
 from fastmcp.utilities.logging import get_logger
 from fastmcp.utilities.ui import create_secure_html_response
 
@@ -60,6 +61,16 @@ def _make_client_key(self, client_id: str, redirect_uri: str | AnyUrl) -> str:
         normalized = self._normalize_uri(str(redirect_uri))
         return f"{client_id}:{normalized}"
 
+    def _validate_client_redirect_uri(
+        self: OAuthProxy,
+        redirect_uri: str,
+    ) -> bool:
+        """Validate a stored transaction redirect URI before sending a browser to it."""
+        return validate_redirect_uri(
+            redirect_uri=redirect_uri,
+            allowed_patterns=self._allowed_client_redirect_uris,
+        )
+
     def _cookie_name(self: OAuthProxy, base_name: str) -> str:
         """Return secure cookie name for HTTPS, fallback for HTTP development."""
         if self._is_https:
@@ -361,6 +372,18 @@ async def _show_consent_page(
                     return response
 
                 if client_key in denied:
+                    if not self._validate_client_redirect_uri(
+                        txn["client_redirect_uri"]
+                    ):
+                        logger.warning(
+                            "Blocked consent denial redirect to disallowed URI for transaction %s",
+                            txn_id,
+                        )
+                        return create_secure_html_response(
+                            "<h1>Error</h1><p>Invalid redirect URI</p>",
+                            status_code=400,
+                        )
+
                     callback_params = {
                         "error": "access_denied",
                         "state": txn.get("client_state") or "",
@@ -526,6 +549,16 @@ async def _submit_consent(
             return response
 
         elif action == "deny":
+            if not self._validate_client_redirect_uri(txn["client_redirect_uri"]):
+                logger.warning(
+                    "Blocked consent denial redirect to disallowed URI for transaction %s",
+                    txn_id,
+                )
+                return create_secure_html_response(
+                    "<h1>Error</h1><p>Invalid redirect URI</p>",
+                    status_code=400,
+                )
+
             callback_params = {
                 "error": "access_denied",
                 "state": txn.get("client_state") or "",

fastmcp_slim/fastmcp/server/auth/oauth_proxy/models.py

@@ -243,14 +243,9 @@ def validate_redirect_uri(self, redirect_uri: AnyUrl | None) -> AnyUrl:
                         f"Invalid CIMD redirect_uri: {e}"
                     ) from e
 
-                # Respect proxy-level redirect URI restrictions even when the
-                # client omits redirect_uri and we fall back to CIMD defaults.
-                if (
-                    self.allowed_redirect_uri_patterns is not None
-                    and not validate_redirect_uri(
-                        redirect_uri=resolved,
-                        allowed_patterns=self.allowed_redirect_uri_patterns,
-                    )
+                if not validate_redirect_uri(
+                    redirect_uri=resolved,
+                    allowed_patterns=self.allowed_redirect_uri_patterns,
                 ):
                     raise InvalidRedirectUriError(
                         f"Redirect URI '{resolved}' does not match allowed patterns."
@@ -263,6 +258,11 @@ def validate_redirect_uri(self, redirect_uri: AnyUrl | None) -> AnyUrl:
             )
 
         if redirect_uri is not None:
+            if not validate_redirect_uri(redirect_uri, None):
+                raise InvalidRedirectUriError(
+                    f"Redirect URI '{redirect_uri}' uses an unsafe scheme."
+                )
+
             cimd_redirect_uris = (
                 self.cimd_document.redirect_uris if self.cimd_document else None
             )
@@ -312,9 +312,8 @@ def validate_redirect_uri(self, redirect_uri: AnyUrl | None) -> AnyUrl:
         # (handles the single-registered-URI shortcut for DCR clients), then validate
         # the resolved URI against patterns so [] and other restrictions are enforced.
         resolved = super().validate_redirect_uri(redirect_uri)
-        if self.allowed_redirect_uri_patterns is not None:
-            if not validate_redirect_uri(resolved, self.allowed_redirect_uri_patterns):
-                raise InvalidRedirectUriError(
-                    f"Redirect URI '{resolved}' does not match allowed patterns."
-                )
+        if not validate_redirect_uri(resolved, self.allowed_redirect_uri_patterns):
+            raise InvalidRedirectUriError(
+                f"Redirect URI '{resolved}' does not match allowed patterns."
+            )
         return resolved

fastmcp_slim/fastmcp/server/auth/oauth_proxy/proxy.py

@@ -48,6 +48,7 @@
     AuthorizationParams,
     AuthorizeError,
     RefreshToken,
+    RegistrationError,
     TokenError,
 )
 from mcp.server.auth.routes import build_metadata, cors_middleware
@@ -91,6 +92,7 @@
     _hash_token,
 )
 from fastmcp.server.auth.oauth_proxy.ui import create_error_html
+from fastmcp.server.auth.redirect_validation import validate_redirect_uri
 from fastmcp.utilities.auth import parse_scopes
 from fastmcp.utilities.logging import get_logger
 
@@ -301,7 +303,7 @@ def __init__(
             allowed_client_redirect_uris: List of allowed redirect URI patterns for MCP clients.
                 Patterns support wildcards (e.g., "http://localhost:*", "https://*.example.com/*").
                 If None (default), DCR clients use registered redirect URIs, with loopback
-                ports allowed to vary for MCP compatibility.
+                ports allowed to vary for MCP compatibility. Unsafe browser schemes are rejected.
                 If empty list, no redirect URIs are allowed.
                 These are for MCP clients performing loopback redirects, NOT for the upstream OAuth app.
             valid_scopes: List of all the possible valid scopes for a client.
@@ -839,14 +841,27 @@ async def register_client(self, client_info: OAuthClientInformationFull) -> None
         # Create a ProxyDCRClient with configured redirect URI validation
         if client_info.client_id is None:
             raise ValueError("client_id is required for client registration")
+        if client_info.redirect_uris:
+            for redirect_uri in client_info.redirect_uris:
+                if not validate_redirect_uri(
+                    redirect_uri=redirect_uri,
+                    allowed_patterns=self._allowed_client_redirect_uris,
+                ):
+                    raise RegistrationError(
+                        "invalid_redirect_uri",
+                        f"Redirect URI '{redirect_uri}' is not allowed.",
+                    )
+
+        redirect_uris = client_info.redirect_uris or [AnyUrl("http://localhost")]
+
         # We use token_endpoint_auth_method="none" because the proxy handles
         # all upstream authentication. The client_secret must also be None
         # because the SDK requires secrets to be provided if they're set,
         # regardless of auth method.
         proxy_client: ProxyDCRClient = ProxyDCRClient(
             client_id=client_info.client_id,
             client_secret=None,
-            redirect_uris=client_info.redirect_uris or [AnyUrl("http://localhost")],
+            redirect_uris=redirect_uris,
             grant_types=client_info.grant_types
             or ["authorization_code", "refresh_token"],
             scope=client_info.scope or self._default_scope_str,
@@ -2160,13 +2175,25 @@ async def _handle_idp_callback(
                 )
                 if transaction_model:
                     # Forward the error to the client's redirect_uri (RFC 6749 §4.1.2.1)
+                    client_redirect_uri = transaction_model.client_redirect_uri
+                    if not self._validate_client_redirect_uri(client_redirect_uri):
+                        logger.warning(
+                            "Blocked IdP callback error redirect to disallowed URI "
+                            "for transaction %s",
+                            txn_id,
+                        )
+                        html_content = create_error_html(
+                            error_title="OAuth Error",
+                            error_message="Invalid redirect URI",
+                        )
+                        return HTMLResponse(content=html_content, status_code=400)
+
                     error_params: dict[str, str] = {
                         "error": error,
                         "state": transaction_model.client_state,
                     }
                     if error_description:
                         error_params["error_description"] = error_description
-                    client_redirect_uri = transaction_model.client_redirect_uri
                     separator = "&" if "?" in client_redirect_uri else "?"
                     return RedirectResponse(
                         url=f"{client_redirect_uri}{separator}{urlencode(error_params)}",
@@ -2186,6 +2213,20 @@ async def _handle_idp_callback(
                     error_message="Invalid or expired authorization transaction. Please try authenticating again.",
                 )
                 return HTMLResponse(content=html_content, status_code=400)
+
+            if not self._validate_client_redirect_uri(
+                transaction_model.client_redirect_uri
+            ):
+                logger.warning(
+                    "Blocked IdP callback redirect to disallowed URI for transaction %s",
+                    txn_id,
+                )
+                html_content = create_error_html(
+                    error_title="OAuth Error",
+                    error_message="Invalid redirect URI",
+                )
+                return HTMLResponse(content=html_content, status_code=400)
+
             # Verify consent binding cookie to prevent confused deputy attacks.
             # When consent is enabled, the browser that approved consent receives
             # a signed cookie. A different browser (e.g., a victim lured to the

fastmcp_slim/fastmcp/server/auth/oidc_proxy.py

@@ -278,7 +278,7 @@ def __init__(
             allowed_client_redirect_uris: List of allowed redirect URI patterns for MCP clients.
                 Patterns support wildcards (e.g., "http://localhost:*", "https://*.example.com/*").
                 If None (default), DCR clients use registered redirect URIs, with loopback
-                ports allowed to vary for MCP compatibility.
+                ports allowed to vary for MCP compatibility. Unsafe browser schemes are rejected.
                 If empty list, no redirect URIs are allowed.
                 These are for MCP clients performing loopback redirects, NOT for the upstream OAuth app.
             client_storage: Storage backend for OAuth state (client registrations, encrypted tokens).

fastmcp_slim/fastmcp/server/auth/redirect_validation.py

@@ -9,6 +9,15 @@
 
 from pydantic import AnyUrl
 
+UNSAFE_REDIRECT_URI_SCHEMES = frozenset(
+    {
+        "javascript",
+        "data",
+        "file",
+        "vbscript",
+    }
+)
+
 
 def _parse_host_port(netloc: str) -> tuple[str | None, str | None]:
     """Parse host and port from netloc, handling wildcards.
@@ -144,6 +153,15 @@ def _match_path(uri_path: str, pattern_path: str) -> bool:
     return fnmatch.fnmatch(uri_path, pattern_path)
 
 
+def _is_unsafe_redirect_uri(uri: str) -> bool:
+    try:
+        parsed = urlparse(uri)
+    except ValueError:
+        return True
+
+    return parsed.scheme.lower() in UNSAFE_REDIRECT_URI_SCHEMES
+
+
 def matches_allowed_pattern(uri: str, pattern: str) -> bool:
     """Securely check if a URI matches an allowed pattern with wildcard support.
 
@@ -172,6 +190,9 @@ def matches_allowed_pattern(uri: str, pattern: str) -> bool:
     except ValueError:
         return False
 
+    if uri_parsed.scheme.lower() in UNSAFE_REDIRECT_URI_SCHEMES:
+        return False
+
     # SECURITY: Reject URIs with userinfo (user:pass@host)
     # This prevents bypass attacks like http://localhost@evil.com/callback
     # which would match http://localhost:* with naive fnmatch
@@ -216,7 +237,8 @@ def validate_redirect_uri(
 
     Args:
         redirect_uri: The redirect URI to validate
-        allowed_patterns: List of allowed patterns. If None, all URIs are allowed (for DCR compatibility).
+        allowed_patterns: List of allowed patterns. If None, ordinary URIs are allowed
+                         for DCR compatibility, while unsafe browser schemes are rejected.
                          If empty list, no URIs are allowed.
                          To restrict to localhost only, explicitly pass DEFAULT_LOCALHOST_PATTERNS.
 
@@ -228,8 +250,11 @@ def validate_redirect_uri(
 
     uri_str = str(redirect_uri)
 
-    # If no patterns specified, allow all for DCR compatibility
-    # (clients need to dynamically register with their own redirect URIs)
+    if _is_unsafe_redirect_uri(uri_str):
+        return False
+
+    # If no patterns specified, preserve broad DCR compatibility after the
+    # unsafe browser-scheme check above.
     if allowed_patterns is None:
         return True