[PR #5681] fix: send mcpName as state if authUrl doesn't have state #11526

Closed
opened 2026-02-16 18:16:22 -05:00 by yindo · 0 comments
Owner

Original Pull Request: https://github.com/anomalyco/opencode/pull/5681

State: closed
Merged: Yes


Right now, if there's no state in the authorization URL opencode uses the MCP name as state...however it doesn't actually send the state parameter to the authorization server.

This, combined with a bug in better auth (where state comes back as the string undefined) which I'm gonna open a PR for in a minute, means that authentication will fail.

Now this is probably more of a better auth bug, but I would say that even returning an empty state could be problematic and if we are gonna use that state we might just also send it for real. This PR changes that.

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/5681 **State:** closed **Merged:** Yes --- Right now, if there's no `state` in the authorization URL opencode uses the MCP name as state...however it doesn't actually send the `state` parameter to the authorization server. This, combined with a bug in better auth (where `state` comes back as the string `undefined`) which I'm gonna open a PR for in a minute, means that authentication will fail. Now this is probably more of a better auth bug, but I would say that even returning an empty state could be problematic and if we are gonna use that state we might just also send it for real. This PR changes that.
yindo added the pull-request label 2026-02-16 18:16:22 -05:00
yindo closed this issue 2026-02-16 18:16:22 -05:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#11526