github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-22 16:42:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6849] fix(mcp): correct jwks uri #6919

New Issue
Open
opened 2026-03-13 13:17:07 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:17:07 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6849
Author: @Ridhim-RR
Created: 12/18/2025
Status: 🔄 Open

Base: canary ← Head: fix/mcp-incorrect-jwks_uri

📝 Commits (10+)

📊 Changes

2 files changed (+84 additions, -5 deletions)

View changed files

📝 packages/better-auth/src/plugins/mcp/index.ts (+21 -5)
📝 packages/better-auth/src/plugins/mcp/mcp.test.ts (+63 -0)

📄 Description

Closes #6817

Problem
When configuring MCP plugin with oidcConfig: { useJWTPlugin: true } and the JWT plugin, the MCP plugin still advertised jwks_uri as /mcp/jwks in
OAuth metadata endpoints, even though:
• The useJWTPlugin: true flag explicitly delegates JWT signing to the JWT plugin
• The JWT plugin serves JWKS at /jwks (not /mcp/jwks)
• There's no /mcp/jwks endpoint when using the JWT plugin

This caused OAuth clients to receive an incorrect JWKS URI, breaking token verification.

Solution

• Added getJwtPlugin() helper to detect if JWT plugin is installed
• Updated getMCPProviderMetadata() to check useJWTPlugin flag and JWT plugin existence, using /jwks when enabled
• Updated getMCPProtectedResourceMetadata() with the same logic
• Fixed bug: getMCPProviderMetadata() was receiving MCPOptions instead of OIDCOptions (now passes options.oidcConfig)

Changes
• When useJWTPlugin: true and JWT plugin is installed → advertises /jwks
• When useJWTPlugin: false or JWT plugin missing → advertises /mcp/jwks (default)
• Manual override via metadata.jwks_uri still works

Testing

Added test cases verifying:
• OAuth authorization server metadata uses /jwks when useJWTPlugin: true

Summary by cubic

Fixes incorrect jwks_uri in MCP OAuth metadata when useJWTPlugin is enabled by pointing to /jwks (served by the JWT plugin) instead of /mcp/jwks, restoring token verification. Also passes the correct OIDC options and preserves manual jwks_uri overrides.

  • Bug Fixes
    • Auto-detect JWT plugin (getJwtPlugin) and honor useJWTPlugin.
    • Default jwks_uri to /jwks when JWT plugin is present; fallback to /mcp/jwks.
    • Apply the same logic to protected resource metadata.
    • Pass options.oidcConfig to getMCPProviderMetadata.
    • Add test verifying /jwks is advertised when useJWTPlugin is true and JWT plugin is installed.

Written for commit 6a250feb10. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6849 **Author:** [@Ridhim-RR](https://github.com/Ridhim-RR) **Created:** 12/18/2025 **Status:** 🔄 Open **Base:** `canary` ← **Head:** `fix/mcp-incorrect-jwks_uri` --- ### 📝 Commits (10+) - [`a87ea44`](https://github.com/better-auth/better-auth/commit/a87ea446a81fadb14b7ac24de37d263d7ccb1a14) fix(mcp) incorrect-jwks-uri - [`0c4ea7d`](https://github.com/better-auth/better-auth/commit/0c4ea7dca198dc665e4cfc4820021f03da20b6c5) Merge branch 'canary' of https://github.com/Ridhim-RR/better-auth into fix/mcp-incorrect-jwks_uri - [`1664ba2`](https://github.com/better-auth/better-auth/commit/1664ba291fb16eb29ca6dea0b6d05b9a111a2b53) Update packages/better-auth/src/plugins/mcp/mcp.test.ts - [`761ad5d`](https://github.com/better-auth/better-auth/commit/761ad5d001791a50dfd6e443c00309b2a4a5c06c) chore(lint): lintingh issue resolved - [`8bdc277`](https://github.com/better-auth/better-auth/commit/8bdc277cac732fd7a7745fb7dcc020a7cef40a41) Merge branch 'fix/mcp-incorrect-jwks_uri' of https://github.com/Ridhim-RR/better-auth into fix/mcp-incorrect-jwks_uri - [`175aad6`](https://github.com/better-auth/better-auth/commit/175aad69fffbf7a3a2e91b534ade52eb6e9d5cff) chore(lint): linting issue - [`9cb31ea`](https://github.com/better-auth/better-auth/commit/9cb31ea46ee9d995d6980528c5bc8db692ea729c) chore(comment): remove comment - [`d57e43d`](https://github.com/better-auth/better-auth/commit/d57e43d19650bfc78e1ac1fd2c316dc8f279c650) Merge branch 'canary' into fix/mcp-incorrect-jwks_uri - [`1dc3176`](https://github.com/better-auth/better-auth/commit/1dc31760f745636fbae7d912fcf4329b3dfa84b6) Merge branch 'canary' into fix/mcp-incorrect-jwks_uri - [`a4a360a`](https://github.com/better-auth/better-auth/commit/a4a360a6cff2bdf7cc31e0f3d6dae2730a8e4177) Merge branch 'canary' into fix/mcp-incorrect-jwks_uri ### 📊 Changes **2 files changed** (+84 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/plugins/mcp/index.ts` (+21 -5) 📝 `packages/better-auth/src/plugins/mcp/mcp.test.ts` (+63 -0) </details> ### 📄 Description Closes #6817 **Problem** When configuring MCP plugin with oidcConfig: { useJWTPlugin: true } and the JWT plugin, the MCP plugin still advertised jwks_uri as /mcp/jwks in OAuth metadata endpoints, even though: • The useJWTPlugin: true flag explicitly delegates JWT signing to the JWT plugin • The JWT plugin serves JWKS at /jwks (not /mcp/jwks) • There's no /mcp/jwks endpoint when using the JWT plugin This caused OAuth clients to receive an incorrect JWKS URI, breaking token verification. Solution • Added getJwtPlugin() helper to detect if JWT plugin is installed • Updated getMCPProviderMetadata() to check useJWTPlugin flag and JWT plugin existence, using /jwks when enabled • Updated getMCPProtectedResourceMetadata() with the same logic • Fixed bug: getMCPProviderMetadata() was receiving MCPOptions instead of OIDCOptions (now passes options.oidcConfig) **Changes** • When useJWTPlugin: true and JWT plugin is installed → advertises /jwks • When useJWTPlugin: false or JWT plugin missing → advertises /mcp/jwks (default) • Manual override via metadata.jwks_uri still works Testing Added test cases verifying: • OAuth authorization server metadata uses /jwks when useJWTPlugin: true <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Fixes incorrect jwks_uri in MCP OAuth metadata when useJWTPlugin is enabled by pointing to /jwks (served by the JWT plugin) instead of /mcp/jwks, restoring token verification. Also passes the correct OIDC options and preserves manual jwks_uri overrides. - **Bug Fixes** - Auto-detect JWT plugin (getJwtPlugin) and honor useJWTPlugin. - Default jwks_uri to /jwks when JWT plugin is present; fallback to /mcp/jwks. - Apply the same logic to protected resource metadata. - Pass options.oidcConfig to getMCPProviderMetadata. - Add test verifying /jwks is advertised when useJWTPlugin is true and JWT plugin is installed. <sup>Written for commit 6a250feb10c62f724d5c29e89ec36b599006a22b. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:17:07 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#6919