Security considerations section can be improved #3361

Activity

1. loganaden

   added

   bugSomething isn't workingSomething isn't working

   on Sep 14, 2026
2. Babbar-rules commented on Sep 24, 2026

   

   Babbar-rules

   on Sep 24, 2026

   More actions

   @aaronpk @pcarleton
   The linked commit's direction makes sense to me: today the draft spec only requires HTTPS for authorization server endpoints, but bearer tokens are also sent to the MCP server itself, and Protected Resource Metadata tells the client which authorization server to trust. If either is served over plain HTTP, a network attacker can capture tokens or send the client to their own authorization server.

   I'd propose this wording for docs/specification/draft/basic/authorization/security-considerations.mdx (Communication Security):

   1. All authorization server endpoints, including authorization server metadata and client registration endpoints, MUST be served over HTTPS.
   2. MCP server endpoints that accept access tokens, and their Protected Resource Metadata endpoints, MUST be served over HTTPS, unless the MCP server is only reachable on a loopback interface.
   3. All redirect URIs MUST be either localhost or use HTTPS.

   The loopback exception keeps local HTTP MCP servers compliant. It matches the existing localhost exception for redirect URIs and OAuth 2.1's loopback handling.

   Would a PR with this change be welcome? Happy to open one.