github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-07-22 11:49:20 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #3411] offline_access scope fails validation without prompt=consent parameter in MCP plugin #26918

New Issue
Closed
opened 2026-04-17 17:40:05 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-17 17:40:05 -05:00
Owner
Copy Link
Copy Source

Originally created by @atsuki44 on GitHub (Jul 16, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/3411

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Use MCP Inspector to connect to an application with better-auth's MCP plugin enabled
  2. Start the authorization flow (request containing offline_access scope). The authorization endpoint URL will be https://auth.example.com/api/auth/mcp/authorize?response_type=code&client_id=***&code_challenge=***&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A6274%2Foauth%2Fcallback%2Fdebug&scope=openid+profile+email+offline_access&resource=https%3A%2F%2F***
  3. Request is sent to the authorization endpoint
  4. invalid_scope error occurs because prompt=consent parameter is not included
Image

Current vs. Expected behavior

Current behavior

The prompt=consent parameter is required for the offline_access scope to be considered valid
MCP clients that don't send the prompt parameter fail authorization.
This is caused by the following code logic:

const invalidScopes = requestScope.filter((scope) => {
    const isInvalid =
        !opts.scopes.includes(scope) ||
        (scope === "offline_access" && query.prompt !== "consent");
    return isInvalid;
});

Expected behavior

Authorization should work regardless of whether the prompt parameter is present
The prompt=consent parameter is not required according to the MCP Authorization specification

What version of Better Auth are you using?

1.2.12

Provide environment information

- Browser [Chrome]
- Runtime [Cloudflare Workers]

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"

export const auth = betterAuth({
  plugins: [organization(), bearer(), mcp({
      loginPage: 'https://example.com/sign-in',
  })],
});

Additional context

Code location: https://github.com/better-auth/better-auth/blob/7364c169f6de0eec4f095112047e23480b240078/packages/better-auth/src/plugins/mcp/authorize.ts#L130

Proposed fix:

typescriptconst invalidScopes = requestScope.filter((scope) => {
    const isInvalid = !opts.scopes.includes(scope);
    return isInvalid;
});

This fix would improve compatibility with MCP specification-compliant clients and allow standard MCP tools to work properly.

Originally created by @atsuki44 on GitHub (Jul 16, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/3411 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Use MCP Inspector to connect to an application with better-auth's MCP plugin enabled 2. Start the authorization flow (request containing offline_access scope). The authorization endpoint URL will be `https://auth.example.com/api/auth/mcp/authorize?response_type=code&client_id=***&code_challenge=***&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A6274%2Foauth%2Fcallback%2Fdebug&scope=openid+profile+email+offline_access&resource=https%3A%2F%2F***` 3. Request is sent to the authorization endpoint 4. invalid_scope error occurs because prompt=consent parameter is not included <img width="1431" height="773" alt="Image" src="https://github.com/user-attachments/assets/f3b66d91-bf10-478f-847a-9759e98e6724" /> ### Current vs. Expected behavior **Current behavior** The prompt=consent parameter is required for the offline_access scope to be considered valid MCP clients that don't send the prompt parameter fail authorization. This is caused by the following code logic: ```typescript const invalidScopes = requestScope.filter((scope) => { const isInvalid = !opts.scopes.includes(scope) || (scope === "offline_access" && query.prompt !== "consent"); return isInvalid; }); ``` **Expected behavior** Authorization should work regardless of whether the prompt parameter is present The prompt=consent parameter is not required according to the [MCP Authorization specification](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization) ### What version of Better Auth are you using? 1.2.12 ### Provide environment information ```bash - Browser [Chrome] - Runtime [Cloudflare Workers] ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ plugins: [organization(), bearer(), mcp({ loginPage: 'https://example.com/sign-in', })], }); ``` ### Additional context Code location: https://github.com/better-auth/better-auth/blob/7364c169f6de0eec4f095112047e23480b240078/packages/better-auth/src/plugins/mcp/authorize.ts#L130 Proposed fix: ```typescript typescriptconst invalidScopes = requestScope.filter((scope) => { const isInvalid = !opts.scopes.includes(scope); return isInvalid; }); ``` This fix would improve compatibility with MCP specification-compliant clients and allow standard MCP tools to work properly.
GiteaMirror added the locked label 2026-04-17 17:40:05 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels locked
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#26918