fix: handle OAuth error responses returned with HTTP 200 status#1343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
felixweinberger merged 8 commits into from
Jan 26, 2026
Merged

fix: handle OAuth error responses returned with HTTP 200 status #1343

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
521bbc8
fix: handle OAuth error responses returned with HTTP 200 status
christso Dec 28, 2025
b8fdf10
fix: add type safety and changeset
christso Dec 28, 2025
f98b92e
check OAuth error field only on parse failure
christso Jan 8, 2026
d83899b
Merge branch 'main' into fix/oauth-error-response-handling
christso Jan 8, 2026
e9baaa5
Merge branch 'main' into fix/oauth-error-response-handling
christso Jan 16, 2026
af56916
Merge branch 'main' into fix/oauth-error-response-handling
christso Jan 19, 2026
d6c3f65
test: add regression test for OAuth error with HTTP 200 status
felixweinberger Jan 26, 2026
4055465
Merge branch 'main' into fix/oauth-error-response-handling
felixweinberger Jan 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .changeset/oauth-error-http200.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
---
'@modelcontextprotocol/client': patch
---

Fix OAuth error handling for servers returning errors with HTTP 200 status

Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. The SDK now checks for an `error` field in the JSON response before attempting to parse it as tokens, providing users with meaningful error messages.
13 changes: 12 additions & 1 deletion packages/client/src/client/auth.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1088,7 +1088,18 @@ async function executeTokenRequest(
throw await parseErrorResponse(response);
}

return OAuthTokensSchema.parse(await response.json());
const json: unknown = await response.json();

try {
return OAuthTokensSchema.parse(json);
} catch (parseError) {
// Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status.
// Check for error field only if token parsing failed.
if (typeof json === 'object' && json !== null && 'error' in json) {
throw await parseErrorResponse(JSON.stringify(json));
}
throw parseError;
}
}

/**
Expand Down
44 changes: 44 additions & 0 deletions test/integration/test/issues/test_1342OauthErrorHttp200.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
/**
* Regression test for https://github.com/modelcontextprotocol/typescript-sdk/issues/1342
*
* Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status
* instead of 4xx. Previously, the SDK would try to parse these as tokens and fail
* with a confusing Zod validation error. This test verifies that the SDK properly
* detects the error field and surfaces the actual OAuth error message.
*/

import { exchangeAuthorization } from '@modelcontextprotocol/client';
import { describe, expect, it, vi } from 'vitest';

const mockFetch = vi.fn();
vi.stubGlobal('fetch', mockFetch);

describe('Issue #1342: OAuth error response with HTTP 200 status', () => {
const validClientInfo = {
client_id: 'test-client',
client_secret: 'test-secret',
redirect_uris: ['http://localhost:3000/callback'],
token_endpoint_auth_method: 'client_secret_post' as const
};

it('should throw OAuth error when server returns error with HTTP 200', async () => {
// GitHub returns errors with HTTP 200 instead of 4xx
mockFetch.mockResolvedValueOnce({
ok: true,
status: 200,
json: async () => ({
error: 'invalid_client',
error_description: 'The client_id and/or client_secret passed are incorrect.'
})
});

await expect(
exchangeAuthorization('https://auth.example.com', {
clientInformation: validClientInfo,
authorizationCode: 'code123',
codeVerifier: 'verifier123',
redirectUri: 'http://localhost:3000/callback'
})
).rejects.toThrow('The client_id and/or client_secret passed are incorrect.');
});
});
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
fix: handle OAuth error responses returned with HTTP 200 status#1343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

felixweinberger
merged 8 commits into

from

Jan 26, 2026
 Merged


fix: handle OAuth error responses returned with HTTP 200 status
#1343
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
521bbc8

fix: handle OAuth error responses returned with HTTP 200 status


christso Dec 28, 2025
b8fdf10

fix: add type safety and changeset


christso Dec 28, 2025
f98b92e

check OAuth error field only on parse failure


christso Jan 8, 2026
d83899b

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 8, 2026
e9baaa5

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 16, 2026
af56916

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 19, 2026
d6c3f65

test: add regression test for OAuth error with HTTP 200 status


felixweinberger Jan 26, 2026
4055465

Merge branch 'main' into fix/oauth-error-response-handling


felixweinberger Jan 26, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 7 additions & 0 deletions
.changeset/oauth-error-http200.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
---
'@modelcontextprotocol/client': patch
---

Fix OAuth error handling for servers returning errors with HTTP 200 status

Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. The SDK now checks for an `error` field in the JSON response before attempting to parse it as tokens, providing users with meaningful error messages.

13 changes: 12 additions & 1 deletion
packages/client/src/client/auth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1088,7 +1088,18 @@ async function executeTokenRequest(
 throw await parseErrorResponse(response);
 }

 return OAuthTokensSchema.parse(await response.json());
 const json: unknown = await response.json();

 try {
 return OAuthTokensSchema.parse(json);
 } catch (parseError) {
 // Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status.
 // Check for error field only if token parsing failed.
 if (typeof json === 'object' && json !== null && 'error' in json) {
 throw await parseErrorResponse(JSON.stringify(json));
 }
 throw parseError;
 }
}

/**
Expand Down

44 changes: 44 additions & 0 deletions
test/integration/test/issues/test_1342OauthErrorHttp200.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
/**
 * Regression test for https://github.com/modelcontextprotocol/typescript-sdk/issues/1342
 *
 * Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status
 * instead of 4xx. Previously, the SDK would try to parse these as tokens and fail
 * with a confusing Zod validation error. This test verifies that the SDK properly
 * detects the error field and surfaces the actual OAuth error message.
 */

import { exchangeAuthorization } from '@modelcontextprotocol/client';
import { describe, expect, it, vi } from 'vitest';

const mockFetch = vi.fn();
vi.stubGlobal('fetch', mockFetch);

describe('Issue #1342: OAuth error response with HTTP 200 status', () => {
 const validClientInfo = {
 client_id: 'test-client',
 client_secret: 'test-secret',
 redirect_uris: ['http://localhost:3000/callback'],
 token_endpoint_auth_method: 'client_secret_post' as const
 };

 it('should throw OAuth error when server returns error with HTTP 200', async () => {
 // GitHub returns errors with HTTP 200 instead of 4xx
 mockFetch.mockResolvedValueOnce({
 ok: true,
 status: 200,
 json: async () => ({
 error: 'invalid_client',
 error_description: 'The client_id and/or client_secret passed are incorrect.'
 })
 });

 await expect(
 exchangeAuthorization('https://auth.example.com', {
 clientInformation: validClientInfo,
 authorizationCode: 'code123',
 codeVerifier: 'verifier123',
 redirectUri: 'http://localhost:3000/callback'
 })
 ).rejects.toThrow('The client_id and/or client_secret passed are incorrect.');
 });
});
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: handle OAuth error responses returned with HTTP 200 status#1343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

felixweinberger
merged 8 commits into

from

Jan 26, 2026
 Merged


fix: handle OAuth error responses returned with HTTP 200 status
#1343
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
521bbc8

fix: handle OAuth error responses returned with HTTP 200 status


christso Dec 28, 2025
b8fdf10

fix: add type safety and changeset


christso Dec 28, 2025
f98b92e

check OAuth error field only on parse failure


christso Jan 8, 2026
d83899b

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 8, 2026
e9baaa5

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 16, 2026
af56916

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 19, 2026
d6c3f65

test: add regression test for OAuth error with HTTP 200 status


felixweinberger Jan 26, 2026
4055465

Merge branch 'main' into fix/oauth-error-response-handling


felixweinberger Jan 26, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 7 additions & 0 deletions
.changeset/oauth-error-http200.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
---
'@modelcontextprotocol/client': patch
---

Fix OAuth error handling for servers returning errors with HTTP 200 status

Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. The SDK now checks for an `error` field in the JSON response before attempting to parse it as tokens, providing users with meaningful error messages.

13 changes: 12 additions & 1 deletion
packages/client/src/client/auth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1088,7 +1088,18 @@ async function executeTokenRequest(
 throw await parseErrorResponse(response);
 }

 return OAuthTokensSchema.parse(await response.json());
 const json: unknown = await response.json();

 try {
 return OAuthTokensSchema.parse(json);
 } catch (parseError) {
 // Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status.
 // Check for error field only if token parsing failed.
 if (typeof json === 'object' && json !== null && 'error' in json) {
 throw await parseErrorResponse(JSON.stringify(json));
 }
 throw parseError;
 }
}

/**
Expand Down

44 changes: 44 additions & 0 deletions
test/integration/test/issues/test_1342OauthErrorHttp200.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
/**
 * Regression test for https://github.com/modelcontextprotocol/typescript-sdk/issues/1342
 *
 * Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status
 * instead of 4xx. Previously, the SDK would try to parse these as tokens and fail
 * with a confusing Zod validation error. This test verifies that the SDK properly
 * detects the error field and surfaces the actual OAuth error message.
 */

import { exchangeAuthorization } from '@modelcontextprotocol/client';
import { describe, expect, it, vi } from 'vitest';

const mockFetch = vi.fn();
vi.stubGlobal('fetch', mockFetch);

describe('Issue #1342: OAuth error response with HTTP 200 status', () => {
 const validClientInfo = {
 client_id: 'test-client',
 client_secret: 'test-secret',
 redirect_uris: ['http://localhost:3000/callback'],
 token_endpoint_auth_method: 'client_secret_post' as const
 };

 it('should throw OAuth error when server returns error with HTTP 200', async () => {
 // GitHub returns errors with HTTP 200 instead of 4xx
 mockFetch.mockResolvedValueOnce({
 ok: true,
 status: 200,
 json: async () => ({
 error: 'invalid_client',
 error_description: 'The client_id and/or client_secret passed are incorrect.'
 })
 });

 await expect(
 exchangeAuthorization('https://auth.example.com', {
 clientInformation: validClientInfo,
 authorizationCode: 'code123',
 codeVerifier: 'verifier123',
 redirectUri: 'http://localhost:3000/callback'
 })
 ).rejects.toThrow('The client_id and/or client_secret passed are incorrect.');
 });
});
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: handle OAuth error responses returned with HTTP 200 status#1343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

felixweinberger
merged 8 commits into

from

Jan 26, 2026
 Merged


fix: handle OAuth error responses returned with HTTP 200 status
#1343
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
521bbc8

fix: handle OAuth error responses returned with HTTP 200 status


christso Dec 28, 2025
b8fdf10

fix: add type safety and changeset


christso Dec 28, 2025
f98b92e

check OAuth error field only on parse failure


christso Jan 8, 2026
d83899b

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 8, 2026
e9baaa5

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 16, 2026
af56916

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 19, 2026
d6c3f65

test: add regression test for OAuth error with HTTP 200 status


felixweinberger Jan 26, 2026
4055465

Merge branch 'main' into fix/oauth-error-response-handling


felixweinberger Jan 26, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 7 additions & 0 deletions
.changeset/oauth-error-http200.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
---
'@modelcontextprotocol/client': patch
---

Fix OAuth error handling for servers returning errors with HTTP 200 status

Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. The SDK now checks for an `error` field in the JSON response before attempting to parse it as tokens, providing users with meaningful error messages.

13 changes: 12 additions & 1 deletion
packages/client/src/client/auth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1088,7 +1088,18 @@ async function executeTokenRequest(
 throw await parseErrorResponse(response);
 }

 return OAuthTokensSchema.parse(await response.json());
 const json: unknown = await response.json();

 try {
 return OAuthTokensSchema.parse(json);
 } catch (parseError) {
 // Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status.
 // Check for error field only if token parsing failed.
 if (typeof json === 'object' && json !== null && 'error' in json) {
 throw await parseErrorResponse(JSON.stringify(json));
 }
 throw parseError;
 }
}

/**
Expand Down

44 changes: 44 additions & 0 deletions
test/integration/test/issues/test_1342OauthErrorHttp200.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
/**
 * Regression test for https://github.com/modelcontextprotocol/typescript-sdk/issues/1342
 *
 * Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status
 * instead of 4xx. Previously, the SDK would try to parse these as tokens and fail
 * with a confusing Zod validation error. This test verifies that the SDK properly
 * detects the error field and surfaces the actual OAuth error message.
 */

import { exchangeAuthorization } from '@modelcontextprotocol/client';
import { describe, expect, it, vi } from 'vitest';

const mockFetch = vi.fn();
vi.stubGlobal('fetch', mockFetch);

describe('Issue #1342: OAuth error response with HTTP 200 status', () => {
 const validClientInfo = {
 client_id: 'test-client',
 client_secret: 'test-secret',
 redirect_uris: ['http://localhost:3000/callback'],
 token_endpoint_auth_method: 'client_secret_post' as const
 };

 it('should throw OAuth error when server returns error with HTTP 200', async () => {
 // GitHub returns errors with HTTP 200 instead of 4xx
 mockFetch.mockResolvedValueOnce({
 ok: true,
 status: 200,
 json: async () => ({
 error: 'invalid_client',
 error_description: 'The client_id and/or client_secret passed are incorrect.'
 })
 });

 await expect(
 exchangeAuthorization('https://auth.example.com', {
 clientInformation: validClientInfo,
 authorizationCode: 'code123',
 codeVerifier: 'verifier123',
 redirectUri: 'http://localhost:3000/callback'
 })
 ).rejects.toThrow('The client_id and/or client_secret passed are incorrect.');
 });
});
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
fix: handle OAuth error responses returned with HTTP 200 status#1343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

felixweinberger
merged 8 commits into

from

Jan 26, 2026
 Merged


fix: handle OAuth error responses returned with HTTP 200 status
#1343
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
521bbc8

fix: handle OAuth error responses returned with HTTP 200 status


christso Dec 28, 2025
b8fdf10

fix: add type safety and changeset


christso Dec 28, 2025
f98b92e

check OAuth error field only on parse failure


christso Jan 8, 2026
d83899b

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 8, 2026
e9baaa5

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 16, 2026
af56916

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 19, 2026
d6c3f65

test: add regression test for OAuth error with HTTP 200 status


felixweinberger Jan 26, 2026
4055465

Merge branch 'main' into fix/oauth-error-response-handling


felixweinberger Jan 26, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 7 additions & 0 deletions
.changeset/oauth-error-http200.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
---
'@modelcontextprotocol/client': patch
---

Fix OAuth error handling for servers returning errors with HTTP 200 status

Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. The SDK now checks for an `error` field in the JSON response before attempting to parse it as tokens, providing users with meaningful error messages.

13 changes: 12 additions & 1 deletion
packages/client/src/client/auth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1088,7 +1088,18 @@ async function executeTokenRequest(
 throw await parseErrorResponse(response);
 }

 return OAuthTokensSchema.parse(await response.json());
 const json: unknown = await response.json();

 try {
 return OAuthTokensSchema.parse(json);
 } catch (parseError) {
 // Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status.
 // Check for error field only if token parsing failed.
 if (typeof json === 'object' && json !== null && 'error' in json) {
 throw await parseErrorResponse(JSON.stringify(json));
 }
 throw parseError;
 }
}

/**
Expand Down

44 changes: 44 additions & 0 deletions
test/integration/test/issues/test_1342OauthErrorHttp200.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
/**
 * Regression test for https://github.com/modelcontextprotocol/typescript-sdk/issues/1342
 *
 * Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status
 * instead of 4xx. Previously, the SDK would try to parse these as tokens and fail
 * with a confusing Zod validation error. This test verifies that the SDK properly
 * detects the error field and surfaces the actual OAuth error message.
 */

import { exchangeAuthorization } from '@modelcontextprotocol/client';
import { describe, expect, it, vi } from 'vitest';

const mockFetch = vi.fn();
vi.stubGlobal('fetch', mockFetch);

describe('Issue #1342: OAuth error response with HTTP 200 status', () => {
 const validClientInfo = {
 client_id: 'test-client',
 client_secret: 'test-secret',
 redirect_uris: ['http://localhost:3000/callback'],
 token_endpoint_auth_method: 'client_secret_post' as const
 };

 it('should throw OAuth error when server returns error with HTTP 200', async () => {
 // GitHub returns errors with HTTP 200 instead of 4xx
 mockFetch.mockResolvedValueOnce({
 ok: true,
 status: 200,
 json: async () => ({
 error: 'invalid_client',
 error_description: 'The client_id and/or client_secret passed are incorrect.'
 })
 });

 await expect(
 exchangeAuthorization('https://auth.example.com', {
 clientInformation: validClientInfo,
 authorizationCode: 'code123',
 codeVerifier: 'verifier123',
 redirectUri: 'http://localhost:3000/callback'
 })
 ).rejects.toThrow('The client_id and/or client_secret passed are incorrect.');
 });
});
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: handle OAuth error responses returned with HTTP 200 status#1343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

felixweinberger
merged 8 commits into

from

Jan 26, 2026
 Merged


fix: handle OAuth error responses returned with HTTP 200 status
#1343
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
521bbc8

fix: handle OAuth error responses returned with HTTP 200 status


christso Dec 28, 2025
b8fdf10

fix: add type safety and changeset


christso Dec 28, 2025
f98b92e

check OAuth error field only on parse failure


christso Jan 8, 2026
d83899b

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 8, 2026
e9baaa5

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 16, 2026
af56916

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 19, 2026
d6c3f65

test: add regression test for OAuth error with HTTP 200 status


felixweinberger Jan 26, 2026
4055465

Merge branch 'main' into fix/oauth-error-response-handling


felixweinberger Jan 26, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 7 additions & 0 deletions
.changeset/oauth-error-http200.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
---
'@modelcontextprotocol/client': patch
---

Fix OAuth error handling for servers returning errors with HTTP 200 status

Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. The SDK now checks for an `error` field in the JSON response before attempting to parse it as tokens, providing users with meaningful error messages.

13 changes: 12 additions & 1 deletion
packages/client/src/client/auth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1088,7 +1088,18 @@ async function executeTokenRequest(
 throw await parseErrorResponse(response);
 }

 return OAuthTokensSchema.parse(await response.json());
 const json: unknown = await response.json();

 try {
 return OAuthTokensSchema.parse(json);
 } catch (parseError) {
 // Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status.
 // Check for error field only if token parsing failed.
 if (typeof json === 'object' && json !== null && 'error' in json) {
 throw await parseErrorResponse(JSON.stringify(json));
 }
 throw parseError;
 }
}

/**
Expand Down

44 changes: 44 additions & 0 deletions
test/integration/test/issues/test_1342OauthErrorHttp200.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
/**
 * Regression test for https://github.com/modelcontextprotocol/typescript-sdk/issues/1342
 *
 * Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status
 * instead of 4xx. Previously, the SDK would try to parse these as tokens and fail
 * with a confusing Zod validation error. This test verifies that the SDK properly
 * detects the error field and surfaces the actual OAuth error message.
 */

import { exchangeAuthorization } from '@modelcontextprotocol/client';
import { describe, expect, it, vi } from 'vitest';

const mockFetch = vi.fn();
vi.stubGlobal('fetch', mockFetch);

describe('Issue #1342: OAuth error response with HTTP 200 status', () => {
 const validClientInfo = {
 client_id: 'test-client',
 client_secret: 'test-secret',
 redirect_uris: ['http://localhost:3000/callback'],
 token_endpoint_auth_method: 'client_secret_post' as const
 };

 it('should throw OAuth error when server returns error with HTTP 200', async () => {
 // GitHub returns errors with HTTP 200 instead of 4xx
 mockFetch.mockResolvedValueOnce({
 ok: true,
 status: 200,
 json: async () => ({
 error: 'invalid_client',
 error_description: 'The client_id and/or client_secret passed are incorrect.'
 })
 });

 await expect(
 exchangeAuthorization('https://auth.example.com', {
 clientInformation: validClientInfo,
 authorizationCode: 'code123',
 codeVerifier: 'verifier123',
 redirectUri: 'http://localhost:3000/callback'
 })
 ).rejects.toThrow('The client_id and/or client_secret passed are incorrect.');
 });
});
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: handle OAuth error responses returned with HTTP 200 status#1343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

felixweinberger
merged 8 commits into

from

Jan 26, 2026
 Merged


fix: handle OAuth error responses returned with HTTP 200 status
#1343
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
521bbc8

fix: handle OAuth error responses returned with HTTP 200 status


christso Dec 28, 2025
b8fdf10

fix: add type safety and changeset


christso Dec 28, 2025
f98b92e

check OAuth error field only on parse failure


christso Jan 8, 2026
d83899b

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 8, 2026
e9baaa5

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 16, 2026
af56916

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 19, 2026
d6c3f65

test: add regression test for OAuth error with HTTP 200 status


felixweinberger Jan 26, 2026
4055465

Merge branch 'main' into fix/oauth-error-response-handling


felixweinberger Jan 26, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 7 additions & 0 deletions
.changeset/oauth-error-http200.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
---
'@modelcontextprotocol/client': patch
---

Fix OAuth error handling for servers returning errors with HTTP 200 status

Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. The SDK now checks for an `error` field in the JSON response before attempting to parse it as tokens, providing users with meaningful error messages.

13 changes: 12 additions & 1 deletion
packages/client/src/client/auth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1088,7 +1088,18 @@ async function executeTokenRequest(
 throw await parseErrorResponse(response);
 }

 return OAuthTokensSchema.parse(await response.json());
 const json: unknown = await response.json();

 try {
 return OAuthTokensSchema.parse(json);
 } catch (parseError) {
 // Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status.
 // Check for error field only if token parsing failed.
 if (typeof json === 'object' && json !== null && 'error' in json) {
 throw await parseErrorResponse(JSON.stringify(json));
 }
 throw parseError;
 }
}

/**
Expand Down

44 changes: 44 additions & 0 deletions
test/integration/test/issues/test_1342OauthErrorHttp200.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
/**
 * Regression test for https://github.com/modelcontextprotocol/typescript-sdk/issues/1342
 *
 * Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status
 * instead of 4xx. Previously, the SDK would try to parse these as tokens and fail
 * with a confusing Zod validation error. This test verifies that the SDK properly
 * detects the error field and surfaces the actual OAuth error message.
 */

import { exchangeAuthorization } from '@modelcontextprotocol/client';
import { describe, expect, it, vi } from 'vitest';

const mockFetch = vi.fn();
vi.stubGlobal('fetch', mockFetch);

describe('Issue #1342: OAuth error response with HTTP 200 status', () => {
 const validClientInfo = {
 client_id: 'test-client',
 client_secret: 'test-secret',
 redirect_uris: ['http://localhost:3000/callback'],
 token_endpoint_auth_method: 'client_secret_post' as const
 };

 it('should throw OAuth error when server returns error with HTTP 200', async () => {
 // GitHub returns errors with HTTP 200 instead of 4xx
 mockFetch.mockResolvedValueOnce({
 ok: true,
 status: 200,
 json: async () => ({
 error: 'invalid_client',
 error_description: 'The client_id and/or client_secret passed are incorrect.'
 })
 });

 await expect(
 exchangeAuthorization('https://auth.example.com', {
 clientInformation: validClientInfo,
 authorizationCode: 'code123',
 codeVerifier: 'verifier123',
 redirectUri: 'http://localhost:3000/callback'
 })
 ).rejects.toThrow('The client_id and/or client_secret passed are incorrect.');
 });
});
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
fix: handle OAuth error responses returned with HTTP 200 status#1343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

felixweinberger
merged 8 commits into

from

Jan 26, 2026
 Merged


fix: handle OAuth error responses returned with HTTP 200 status
#1343
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
521bbc8

fix: handle OAuth error responses returned with HTTP 200 status


christso Dec 28, 2025
b8fdf10

fix: add type safety and changeset


christso Dec 28, 2025
f98b92e

check OAuth error field only on parse failure


christso Jan 8, 2026
d83899b

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 8, 2026
e9baaa5

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 16, 2026
af56916

Merge branch 'main' into fix/oauth-error-response-handling


christso Jan 19, 2026
d6c3f65

test: add regression test for OAuth error with HTTP 200 status


felixweinberger Jan 26, 2026
4055465

Merge branch 'main' into fix/oauth-error-response-handling


felixweinberger Jan 26, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


7 changes: 7 additions & 0 deletions
.changeset/oauth-error-http200.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
---
'@modelcontextprotocol/client': patch
---

Fix OAuth error handling for servers returning errors with HTTP 200 status

Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. The SDK now checks for an `error` field in the JSON response before attempting to parse it as tokens, providing users with meaningful error messages.

13 changes: 12 additions & 1 deletion
packages/client/src/client/auth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1088,7 +1088,18 @@ async function executeTokenRequest(
 throw await parseErrorResponse(response);
 }

 return OAuthTokensSchema.parse(await response.json());
 const json: unknown = await response.json();

 try {
 return OAuthTokensSchema.parse(json);
 } catch (parseError) {
 // Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status.
 // Check for error field only if token parsing failed.
 if (typeof json === 'object' && json !== null && 'error' in json) {
 throw await parseErrorResponse(JSON.stringify(json));
 }
 throw parseError;
 }
}

/**
Expand Down

44 changes: 44 additions & 0 deletions
test/integration/test/issues/test_1342OauthErrorHttp200.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
/**
 * Regression test for https://github.com/modelcontextprotocol/typescript-sdk/issues/1342
 *
 * Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status
 * instead of 4xx. Previously, the SDK would try to parse these as tokens and fail
 * with a confusing Zod validation error. This test verifies that the SDK properly
 * detects the error field and surfaces the actual OAuth error message.
 */

import { exchangeAuthorization } from '@modelcontextprotocol/client';
import { describe, expect, it, vi } from 'vitest';

const mockFetch = vi.fn();
vi.stubGlobal('fetch', mockFetch);

describe('Issue #1342: OAuth error response with HTTP 200 status', () => {
 const validClientInfo = {
 client_id: 'test-client',
 client_secret: 'test-secret',
 redirect_uris: ['http://localhost:3000/callback'],
 token_endpoint_auth_method: 'client_secret_post' as const
 };

 it('should throw OAuth error when server returns error with HTTP 200', async () => {
 // GitHub returns errors with HTTP 200 instead of 4xx
 mockFetch.mockResolvedValueOnce({
 ok: true,
 status: 200,
 json: async () => ({
 error: 'invalid_client',
 error_description: 'The client_id and/or client_secret passed are incorrect.'
 })
 });

 await expect(
 exchangeAuthorization('https://auth.example.com', {
 clientInformation: validClientInfo,
 authorizationCode: 'code123',
 codeVerifier: 'verifier123',
 redirectUri: 'http://localhost:3000/callback'
 })
 ).rejects.toThrow('The client_id and/or client_secret passed are incorrect.');
 });
});
Loading