fix(core): return OAuth discovery 401 for unauthenticated MCP POSTs by pejmanjohn · Pull Request #371 · emdash-cms/emdash

pejmanjohn · 2026-04-08T04:55:43Z

What does this PR do?

Fixes OAuth discovery for unauthenticated MCP POST requests on /_emdash/api/mcp.

Some MCP clients, including Codex, probe the MCP endpoint with POST when starting auth discovery. Before this change, unauthenticated POST /_emdash/api/mcp requests without X-EmDash-Request: 1 were rejected by the generic CSRF middleware with 403 CSRF_REJECTED before the MCP auth path could return 401 Unauthorized with the WWW-Authenticate header.

That prevented OAuth-capable MCP clients from starting discovery even though EmDash already exposed valid OAuth metadata endpoints.

This change:

allows tokenless MCP discovery POST requests with no authenticated session to reach the existing 401 + WWW-Authenticate response
preserves CSRF rejection for session/cookie-backed MCP POST requests without X-EmDash-Request: 1
keeps non-MCP API CSRF behavior unchanged
adds regression tests for unauthenticated MCP POST, invalid bearer token handling, and the non-regression CSRF cases

Type of change

Checklist

I have read CONTRIBUTING.md
pnpm typecheck passes
pnpm --silent lint:json | jq '.diagnostics | length' returns 0
pnpm test passes (or targeted tests for my change)
pnpm format has been run
I have added/updated tests for my changes (if applicable)
I have added a changeset (if this PR changes a published package)
New features link to an approved Discussion: https://github.com/emdash-cms/emdash/discussions/...

AI-generated code disclosure

This PR includes AI-generated code

Screenshots / test output

Ran:

pnpm build
pnpm typecheck
pnpm typecheck:demos
pnpm --filter emdash exec vitest run tests/unit/auth/mcp-discovery-post.test.ts tests/unit/auth/discovery-endpoints.test.ts tests/unit/api/csrf.test.ts tests/unit/mcp/authorization.test.ts

Notes:

pnpm --silent lint:json | jq '.diagnostics | length' currently reports 3 existing warnings in unrelated files.

changeset-bot · 2026-04-08T04:55:51Z

🦋 Changeset detected

Latest commit: 5f83a8d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 15 packages

Name	Type
emdash	Patch
@emdash-cms/cloudflare	Patch
@emdash-cms/plugin-ai-moderation	Patch
@emdash-cms/plugin-atproto	Patch
@emdash-cms/plugin-audit-log	Patch
@emdash-cms/plugin-color	Patch
@emdash-cms/plugin-embeds	Patch
@emdash-cms/plugin-forms	Patch
@emdash-cms/plugin-webhook-notifier	Patch
@emdash-cms/admin	Patch
@emdash-cms/auth	Patch
@emdash-cms/blocks	Patch
@emdash-cms/gutenberg-to-portable-text	Patch
@emdash-cms/x402	Patch
create-emdash	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-04-09T08:32:16Z

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@371

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@371

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@371

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@371

emdash

npm i https://pkg.pr.new/emdash@371

create-emdash

npm i https://pkg.pr.new/create-emdash@371

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@371

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@371

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@371

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@371

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@371

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@371

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@371

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@371

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@371

commit: 5f83a8d

ascorbic

Thanks for the PR. The fix is in the right area, but I think there's a simpler approach. No MCP client will ever authenticate via session cookies, so we don't need to preserve CSRF for session-backed MCP requests: we can just make MCP bearer-only. I've made a couple of inline suggesitons, but it might need a few more as I've not tested. Basically for MCP requests we want to exempt from CSRF, but only allow token auth.

ascorbic · 2026-04-09T08:58:52Z

 	const isOAuthConsent = url.pathname.startsWith("/_emdash/oauth/authorize");
 	if (
 		isApiRoute &&
 		!isTokenAuth &&
 		!isOAuthConsent &&


Suggested change

const isOAuthConsent = url.pathname.startsWith("/_emdash/oauth/authorize");

const isMcpEndpoint = url.pathname === "/_emdash/api/mcp";

if (

isApiRoute &&

!isTokenAuth &&

!isOAuthConsent &&

!isMcpEndpoint &&

@ascorbic Updated this to match the broader bearer-only direction. MCP now short-circuits before session or external auth: requests without a valid bearer token return the discovery-style 401 with WWW-Authenticate, and session-backed MCP requests are no longer accepted even if the CSRF header is present.

I also updated the regression test to assert that MCP POST discovery no longer reads session state at all. Verified with pnpm --filter emdash test tests/unit/auth/mcp-discovery-post.test.ts, pnpm test tests/unit/auth/*.test.ts, pnpm typecheck, and pnpm --silent lint:json | jq .diagnostics | length.

ascorbic · 2026-04-11T13:05:57Z

+		{
+			status: 401,
+			headers: {
+				"WWW-Authenticate": `Bearer resource_metadata="${url.origin}/.well-known/oauth-protected-resource"`,


This will need to use getPublicOrigin instead of url.origin, meaning mcpUnauthorizedResponse needs to be passed the config.

@ascorbic Updated this to route the anonymous MCP discovery 401 through getPublicOrigin(...), so the WWW-Authenticate resource metadata URL now respects siteUrl / reverse-proxy deployments instead of using the raw request origin.

I also added a regression covering the configured public-origin case on the anonymous MCP POST path.

Verified with:

pnpm --filter emdash test tests/unit/auth/mcp-discovery-post.test.ts

pnpm test tests/unit/auth/*.test.ts

pnpm typecheck

pnpm --silent lint:json | jq .diagnostics | length

pejmanjohn · 2026-04-11T20:12:01Z

@ascorbic rebased this branch onto current main to clear the needs-rebase conflict, and the MCP public-origin follow-up is included in the rebased history. I reran:

pnpm --filter emdash test tests/unit/auth/mcp-discovery-post.test.ts
pnpm test tests/unit/auth/*.test.ts
pnpm typecheck

The PR was already ready for review, so it remains ready.

Copilot

Pull request overview

This PR adjusts the core Astro auth middleware so unauthenticated MCP POST /_emdash/api/mcp requests can reach the MCP auth path and return the OAuth discovery-style 401 (with WWW-Authenticate) instead of being blocked earlier by CSRF enforcement.

Changes:

Adds an MCP-specific early 401 + WWW-Authenticate response path for non-token requests.
Refactors CSRF rejection response and unsafe-method detection into small helpers.
Adds unit tests covering unauthenticated MCP POST discovery responses and invalid bearer token handling, plus a CSRF non-regression test for non-MCP API routes.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
packages/core/src/astro/middleware/auth.ts	Adds MCP-specific unauthorized response path before CSRF enforcement; refactors CSRF response building.
packages/core/tests/unit/auth/mcp-discovery-post.test.ts	Adds regression tests for MCP discovery via POST and invalid bearer token behavior.
.changeset/fresh-mice-battle.md	Publishes a patch changeset describing the MCP discovery fix.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-12T11:06:23Z

+	// MCP discovery/tooling is bearer-only. Session/external auth should never
+	// be consulted for this endpoint, and unauthenticated requests must return
+	// the OAuth discovery-style 401 response.
+	const method = context.request.method.toUpperCase();
+	const isMcpEndpoint = url.pathname === MCP_ENDPOINT_PATH;
+	if (isMcpEndpoint && !isTokenAuth) {
+		return mcpUnauthorizedResponse(url, context.locals.emdash?.config);
+	}


The new MCP short-circuit runs before the CSRF check, so any non-token request to /_emdash/api/mcp (including browser requests carrying session cookies but missing X-EmDash-Request: 1) will now return the OAuth-discovery 401 instead of 403 CSRF_REJECTED. This doesn’t match the PR description’s goal of preserving CSRF rejection for session/cookie-backed MCP POSTs. If that behavior is still desired, gate this early-return to only apply to truly anonymous discovery (e.g., no Cookie/session cookie present), and add a regression test covering the cookie-present + missing-CSRF-header case.

Copilot · 2026-04-12T11:06:23Z

+const MCP_ENDPOINT_PATH = "/_emdash/api/mcp";
+


MCP_ENDPOINT_PATH is introduced, but the file still contains hard-coded "/_emdash/api/mcp" comparisons elsewhere (e.g., the invalid-token WWW-Authenticate branch and the scope rule). To avoid drift, prefer using the constant consistently in this module.

Copilot · 2026-04-12T11:06:23Z

+beforeEach(() => {
+	vi.clearAllMocks();
+});
+
+afterEach(() => {
+	vi.clearAllMocks();
+});


vi.clearAllMocks() is called in both beforeEach and afterEach. One of these is redundant and removing the duplicate will reduce noise in the test setup while keeping the same isolation behavior.

ascorbic

Great! Thanks

…mdash-cms#371) * fix(core): return OAuth discovery 401 for MCP POSTs * chore: add changeset for MCP OAuth discovery fix * style: format * fix(core): centralize MCP discovery auth handling * style: format * fix(core): make MCP auth bearer-only * fix(core): use public origin for MCP discovery 401 --------- Co-authored-by: emdashbot[bot] <emdashbot[bot]@users.noreply.github.com>

github-actions Bot added area/core size/L cla: signed labels Apr 8, 2026

pejmanjohn marked this pull request as ready for review April 8, 2026 04:58

ascorbic reviewed Apr 9, 2026

View reviewed changes

ascorbic reviewed Apr 11, 2026

View reviewed changes

github-actions Bot added the needs-rebase label Apr 11, 2026

pejmanjohn and others added 7 commits April 11, 2026 13:06

fix(core): return OAuth discovery 401 for MCP POSTs

5948993

chore: add changeset for MCP OAuth discovery fix

e3eb9ca

style: format

116e6a9

fix(core): centralize MCP discovery auth handling

7f57fc7

style: format

4fa8c41

fix(core): make MCP auth bearer-only

0ed9652

fix(core): use public origin for MCP discovery 401

5f83a8d

pejmanjohn force-pushed the contrib/emdash-cms-emdash-mcp-post-oauth-discovery branch from 0d0526d to 5f83a8d Compare April 11, 2026 20:11

github-actions Bot removed the needs-rebase label Apr 11, 2026

ascorbic requested a review from Copilot April 12, 2026 11:01

Copilot started reviewing on behalf of ascorbic April 12, 2026 11:03 View session

Copilot AI reviewed Apr 12, 2026

View reviewed changes

ascorbic approved these changes Apr 12, 2026

View reviewed changes

ascorbic merged commit 5320321 into emdash-cms:main Apr 12, 2026
33 checks passed

This was referenced Apr 12, 2026

ci: release #396

Closed

ci: release #486

Merged

Navigation Menu

Uh oh!

fix(core): return OAuth discovery 401 for unauthenticated MCP POSTs - #371

fix(core): return OAuth discovery 401 for unauthenticated MCP POSTs#371
ascorbic merged 7 commits into
emdash-cms:mainfrom
pejmanjohn:contrib/emdash-cms-emdash-mcp-post-oauth-discovery

pejmanjohn commented Apr 8, 2026

changeset-bot Bot commented Apr 8, 2026 •

edited

Loading

pkg-pr-new Bot commented Apr 9, 2026 •

edited

Loading

ascorbic left a comment

ascorbic Apr 9, 2026

pejmanjohn Apr 9, 2026 •

edited

Loading

Uh oh!

ascorbic Apr 11, 2026

pejmanjohn Apr 11, 2026 •

edited

Loading

pejmanjohn commented Apr 11, 2026

Copilot AI left a comment

Copilot AI Apr 12, 2026

Copilot AI Apr 12, 2026

Copilot AI Apr 12, 2026

ascorbic left a comment

Uh oh!

Labels

3 participants

Uh oh!

Conversation

pejmanjohn commented Apr 8, 2026

What does this PR do?

Type of change

Checklist

AI-generated code disclosure

Screenshots / test output

changeset-bot Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

pkg-pr-new Bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ascorbic left a comment

Choose a reason for hiding this comment

ascorbic Apr 9, 2026

Choose a reason for hiding this comment

pejmanjohn Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ascorbic Apr 11, 2026

Choose a reason for hiding this comment

pejmanjohn Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

pejmanjohn commented Apr 11, 2026

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

ascorbic left a comment

Choose a reason for hiding this comment

Uh oh!

Labels

3 participants

changeset-bot Bot commented Apr 8, 2026 •

edited

Loading

pkg-pr-new Bot commented Apr 9, 2026 •

edited

Loading

pejmanjohn Apr 9, 2026 •

edited

Loading

pejmanjohn Apr 11, 2026 •

edited

Loading