Implement SEP-2468: Recommend Issuer (iss) Parameter in MCP Auth Responses

[felixweinberger]

This is a tracking issue for implementation of SEP-2468.

[mattzcarey]

Status — SEP-2468 (Recommend iss parameter / RFC 9207 validation)

Track: C — independent, starts now. Reference implementation already exists.
Spec: seps/2468-recommend-issuer-claim-for-auth.md · merged via spec#2646

What's done — open reference impl

• feat(client/auth): RFC 9207 iss parameter validation (SEP-2468 reference impl) #1957 (open, REVIEW_REQUIRED, by @pcarleton): feat(client/auth): RFC 9207 iss parameter validation (SEP-2468 reference impl)
  • Adds finishAuth(code, iss?) that validates the received iss against the cached AS metadata before exchanging the code, using the RFC 9207 §2.4 decision table keyed on authorization_response_iss_parameter_supported.
  • Mirrors the approach in go-sdk#859.
  • Behavioral note in the PR: signature is additive, but when an AS advertises authorization_response_iss_parameter_supported: true, an authorization response missing iss is rejected — that's a behavior change relative to today.

Outstanding (acceptance criteria, summary)

• R-2468-1 (wire): Client MUST compare iss in the redirect callback against the recorded issuer; reject on mismatch
• R-2468-3 (sdk): Client MUST record issuer from validated AS metadata before redirecting
• R-2468-5 (wire): Client MUST validate AS metadata per RFC 8414 §3.3 — metadata's issuer must equal the issuer used to construct the well-known URL; if not, MUST NOT use the metadata
• R-2468-6 (wire): If authorization_response_iss_parameter_supported: true AND response lacks iss → reject (decision-table row 2)
• R-2468-7 (wire): If metadata does NOT advertise support but iss is present → still compare to recorded issuer (decision-table row 3)
• R-2468-8 (wire): String comparison only — no scheme/host case folding, no default-port elision, no trailing-slash, no percent-encoding normalization
• R-2468-9 (sdk): On iss mismatch in an error authorization response, client MUST NOT surface error_description / error_uri (attacker-controlled text)
• R-2468-10 (guidance): ASes SHOULD include iss in authorization responses; if they do, MUST set the metadata flag

Action items

1. Review and land feat(client/auth): RFC 9207 iss parameter validation (SEP-2468 reference impl) #1957 — it's the most advanced concrete implementation in the project.
2. Verify it covers the decision-table rows 1-3 plus the error_description suppression (R-2468-9) — the PR description mentions §2.4 but not §2.4 error-response handling.
3. Add tests for each row of the RFC 9207 §2.4 decision table.

Coordination

• Independent of every other SEP. Track C natural primary review.