fix(oauth): reject invalid CIMD client identifiers

docs/cloudflare/oauth-architecture.md

@@ -215,6 +215,14 @@ upstream option, and run
 The regression exercises the production provider with blocked metadata, token
 exchange and refresh, and checks that OAuth validation remains enforced.
 
+The patch also validates CIMD client ID syntax before authorization looks up
+metadata, using the provider's existing validator. Invalid identifiers produce
+`AuthorizationError` and a local `400` without redirecting. Fetch failures and
+invalid metadata for syntactically valid URLs still propagate as `CimdFetchError`.
+Dynamic client registration and the token endpoint retain their existing behavior.
+Run `src/server/oauth/client-id-validation.integration.test.ts` with the command
+above when changing this patch.
+
 ### 2. API Handler
 
 The `apiHandler` is a protected endpoint that requires valid OAuth tokens:

packages/mcp-cloudflare/src/server/oauth/client-id-validation.integration.test.ts

@@ -0,0 +1,68 @@
+import { createExecutionContext, env } from "cloudflare:test";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { PKCE_CODE_CHALLENGE } from "../../test-utils/pkce";
+import handler from "../index";
+import type { Env } from "../types";
+
+const ORIGIN = "https://mcp.sentry.dev";
+const workerEnv = {
+  ...(env as Record<string, unknown>),
+  CF_VERSION_METADATA: { id: "test-version-id" },
+} as Env;
+
+function createAuthorizationRequest(clientId: string) {
+  const url = new URL("/oauth/authorize", ORIGIN);
+  url.search = new URLSearchParams({
+    response_type: "code",
+    client_id: clientId,
+    redirect_uri: "http://127.0.0.1:43127/callback",
+    scope: "org:read",
+    state: "test-state",
+    resource: `${ORIGIN}/mcp`,
+    code_challenge: PKCE_CODE_CHALLENGE,
+    code_challenge_method: "S256",
+  }).toString();
+  return new Request(url);
+}
+
+describe("authorization client ID validation", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it.each([
+    ["whitespace", "https://example.com/client meta.json"],
+    ["invalid percent encoding", "https://example.com/client%2"],
+    ["encoded dot segments", "https://example.com/a/%2e%2e/client.json"],
+    ["userinfo", "https://user:password@example.com/client.json"],
+    ["fragment", "https://example.com/client.json#fragment"],
+  ])("rejects a CIMD client ID containing %s locally", async (_, clientId) => {
+    const fetchSpy = vi.spyOn(globalThis, "fetch");
+    const response = await handler.fetch!(
+      createAuthorizationRequest(clientId),
+      workerEnv,
+      createExecutionContext(),
+    );
+
+    expect(response.status).toBe(400);
+    expect(response.headers.get("Location")).toBeNull();
+    expect(await response.text()).toBe("Invalid client_id");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("preserves an upstream metadata failure for a valid client ID", async () => {
+    const fetchSpy = vi.spyOn(globalThis, "fetch");
+    const response = await handler.fetch!(
+      createAuthorizationRequest(
+        "https://chatgpt.com/oauth/codex/client.json?other-client=1",
+      ),
+      workerEnv,
+      createExecutionContext(),
+    );
+
+    expect(response.status).toBe(500);
+    expect(response.headers.get("Location")).toBeNull();
+    expect(await response.text()).toBe("Internal Server Error");
+    expect(fetchSpy).toHaveBeenCalled();
+  });
+});

patches/@cloudflare__workers-oauth-provider@0.10.3.patch

@@ -1,5 +1,5 @@
 diff --git a/dist/oauth-provider.d.ts b/dist/oauth-provider.d.ts
-index 01141b6b4e708a7f40b32667ed8dd9cf33592888..33c099916cedc3666a5330675f1b3dc88d60a5c1 100644
+index 01141b6b4e708a7f40b32667ed8dd9cf33592888..8778203e3cfdf4c996c3155c67babcfd1956527b 100644
 --- a/dist/oauth-provider.d.ts
 +++ b/dist/oauth-provider.d.ts
 @@ -684,6 +684,12 @@ interface OAuthProviderOptions<Env = Cloudflare.Env> {
@@ -16,7 +16,7 @@ index 01141b6b4e708a7f40b32667ed8dd9cf33592888..33c099916cedc3666a5330675f1b3dc8
     * When true, requested-vs-granted resource validation compares origins only
     * (scheme + host + port) instead of exact URIs. This allows an origin-only
 diff --git a/dist/oauth-provider.js b/dist/oauth-provider.js
-index c15348c226f1064f6c277f45f10740b9266219e9..43b4d2bc3fca7aa844722c57c895c68951b76d55 100644
+index c15348c226f1064f6c277f45f10740b9266219e9..9182e6421c801f03b0b93d543afab5d733e4b2e7 100644
 --- a/dist/oauth-provider.js
 +++ b/dist/oauth-provider.js
 @@ -2806,6 +2806,11 @@ var OAuthProviderImpl = class {
@@ -31,3 +31,18 @@ index c15348c226f1064f6c277f45f10740b9266219e9..43b4d2bc3fca7aa844722c57c895c689
  				return await fetchClientIdMetadataDocument(clientId, this.serverCapabilities);
  			} catch (error) {
  				console.warn(`CIMD fetch failed for ${clientId}:`, error instanceof Error ? error.message : error);
+@@ -3491,6 +3496,14 @@ var OAuthHelpersImpl = class {
+ 		const resourceParams = url.searchParams.getAll("resource");
+ 		const resourceParam = resourceParams.length > 0 ? resourceParams.length === 1 ? resourceParams[0] : resourceParams : void 0;
+ 		if (!clientId) throw new AuthorizationError("invalid_request", { description: "client_id is required" });
++		if (this.provider.options.clientIdMetadataDocumentEnabled && this.provider.isClientMetadataUrl(clientId)) {
++			// Invalid identifiers are request errors, not metadata resolution failures.
++			try {
++				validateClientIdentifierUrl(clientId);
++			} catch {
++				throw new AuthorizationError("invalid_request", { description: "Invalid client_id" });
++			}
++		}
+ 		const clientInfo = await this.lookupClient(clientId);
+ 		if (!clientInfo) throw new AuthorizationError("invalid_request", { description: "Invalid client_id" });
+ 		try {