Fix duplicate OAuth redirect URIs

cliffhall · cliffhall · commit eda547ee7b03 · 2025-10-11T14:35:47.000-04:00
* In auth.ts - add getter for redirect_uris which returns redirectUrl and debugRedirectUrl but de-duped - included comments that explains the problem and link to issue - in clientMetadata getter, - replace hardcoded array value with this..redirect_uris, so it will never contain duplicate uris Fixes #825
diff --git a/client/src/lib/auth.ts b/client/src/lib/auth.ts
@@ -121,10 +121,16 @@ export class InspectorOAuthClientProvider implements OAuthClientProvider {
     return window.location.origin + "/oauth/callback/debug";
   }
 
+  get redirect_uris() {
+    // Normally register both redirect URIs to support both normal and debug flows
+    // In debug subclass, redirectUrl may be the same as debugRedirectUrl, so remove duplicates
+    // See: https://github.com/modelcontextprotocol/inspector/issues/825
+    return [...new Set([this.redirectUrl, this.debugRedirectUrl])];
+  }
+
   get clientMetadata(): OAuthClientMetadata {
-    // Register both redirect URIs to support both normal and debug flows
     return {
-      redirect_uris: [this.redirectUrl, this.debugRedirectUrl],
+      redirect_uris: this.redirect_uris,
       token_endpoint_auth_method: "none",
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
