mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-15 23:32:40 +00:00
ec86ce5cf7
* fix(oauth): use Protected Resource Metadata scopes in MCP DCR flow The Dynamic Client Registration flow seeded the registration request `scope` from the Authorization Server's `scopes_supported` (RFC 8414), which is a full catalog of every scope the AS can grant across all resources. Per RFC 9728 and the MCP Scope Selection Strategy, the resource-specific Protected Resource Metadata `scopes_supported` is the correct, least-privilege source. The PRM is already fetched in this function; this change prefers its `scopes_supported` and keeps the AS `scopes_supported` only as a fallback when the PRM advertises none. Mirrors the static-credentials fix in #24690. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(oauth): trim DCR scope comment per review feedback Shortens the inline comment per review feedback on #25958. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| access_control | ||
| images | ||
| mcp | ||
| telemetry | ||
| actions.py | ||
| anthropic.py | ||
| asgi_middleware.py | ||
| audit.py | ||
| auth.py | ||
| automations.py | ||
| calendar.py | ||
| channels.py | ||
| chat.py | ||
| code_interpreter.py | ||
| embeddings.py | ||
| files.py | ||
| filter.py | ||
| groups.py | ||
| headers.py | ||
| logger.py | ||
| middleware.py | ||
| misc.py | ||
| models.py | ||
| oauth.py | ||
| payload.py | ||
| pdf_generator.py | ||
| plugin.py | ||
| rate_limit.py | ||
| redis.py | ||
| response.py | ||
| sanitize.py | ||
| security_headers.py | ||
| session_pool.py | ||
| task.py | ||
| tools.py | ||
| validate.py | ||
| webhook.py | ||