anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

All MCP oauth flow return potential CSRF attack #6866

New Issue
Open
opened 2026-02-16 18:05:28 -05:00 by yindo · 3 comments
yindo commented 2026-02-16 18:05:28 -05:00
Owner
Copy Link
Copy Source

Originally created by @benjaminshafii on GitHub (Jan 19, 2026).

Originally assigned to: @rekram1-node on GitHub.

Hey been running in a few issues trying to use MCP. And can't spot what I might've done wrong.

I also tried with stripe mcp and got the same results.

Note: I tested this on two independent machines

Description

{
  "$schema": "https://opencode.ai/config.json",
  "autoupdate": true,
  "mcp": {
    "notion": {
      "type": "remote",
      "url": "https://mcp.notion.com/mcp",
      "enabled": true
    }
  }
}

Plugins

n/a

OpenCode version

1.1.25

Steps to reproduce


opencode --version
1.1.25
 opencode mcp auth notion

┌  MCP OAuth Authentication
│
◐  Starting OAuth flow..

See video for additional context

https://github.com/user-attachments/assets/1ab068e6-77b5-4697-95df-15963151d8e3

Screenshot and/or share link

No response

Operating System

26.0.1

Terminal

vscode

Originally created by @benjaminshafii on GitHub (Jan 19, 2026). Originally assigned to: @rekram1-node on GitHub. Hey been running in a few issues trying to use MCP. And can't spot what I might've done wrong. I also tried with stripe mcp and got the same results. Note: I tested this on two independent machines ### Description ```opencode.json { "$schema": "https://opencode.ai/config.json", "autoupdate": true, "mcp": { "notion": { "type": "remote", "url": "https://mcp.notion.com/mcp", "enabled": true } } } ``` ### Plugins n/a ### OpenCode version 1.1.25 ### Steps to reproduce ```sh opencode --version 1.1.25 opencode mcp auth notion ┌ MCP OAuth Authentication │ ◐ Starting OAuth flow.. ``` See video for additional context https://github.com/user-attachments/assets/1ab068e6-77b5-4697-95df-15963151d8e3 ### Screenshot and/or share link _No response_ ### Operating System 26.0.1 ### Terminal vscode
yindo added the bug label 2026-02-16 18:05:28 -05:00
yindo commented 2026-02-16 18:05:28 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 19, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #8682: MCP connection issues with configured servers (Notion MCP mentioned)
  • #7766: OAuth PKCE authentication - shows proper OAuth security patterns that may be missing from MCP OAuth flow
  • #3281: Comprehensive OAuth implementation with CSRF protection via state parameters
  • #8526: Feature request for OAuth login that may need CSRF security considerations

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 19, 2026): This issue might be a duplicate of existing issues. Please check: - #8682: MCP connection issues with configured servers (Notion MCP mentioned) - #7766: OAuth PKCE authentication - shows proper OAuth security patterns that may be missing from MCP OAuth flow - #3281: Comprehensive OAuth implementation with CSRF protection via state parameters - #8526: Feature request for OAuth login that may need CSRF security considerations Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 18:05:28 -05:00
Author
Owner
Copy Link
Copy Source

@danieluhm2004 commented on GitHub (Jan 19, 2026):

Same here.

I checked this.

If even one Opencode client is enabled, OAuth authentication is performed on that server. It seems the state value isn't shared between processes, resulting in a rejection.

I killed all Opencode clients and tried logging in again, and it worked without any issues.

@danieluhm2004 commented on GitHub (Jan 19, 2026): Same here. --- I checked this. If even one Opencode client is enabled, OAuth authentication is performed on that server. It seems the state value isn't shared between processes, resulting in a rejection. I killed all Opencode clients and tried logging in again, and it worked without any issues.
yindo commented 2026-02-16 18:05:28 -05:00
Author
Owner
Copy Link
Copy Source

@raserma commented on GitHub (Jan 20, 2026):

I killed all Opencode clients and tried logging in again, and it worked without any issues.

Thank you, that solved the issue for me 🎉

@raserma commented on GitHub (Jan 20, 2026): > I killed all Opencode clients and tried logging in again, and it worked without any issues. Thank you, that solved the issue for me 🎉
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6866
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?