{"record":{"id":"eea9b92e8d87210b","repo":"different-ai/openwork","slug":"an-enterprise-mcp-oauth-redirect-uri-must-use-http","errorCode":null,"errorMessage":"An enterprise MCP OAuth redirect URI must use HTTP or HTTPS.","messagePattern":"An enterprise MCP OAuth redirect URI must use HTTP or HTTPS\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/enterprise-mcp-client/src/enterprise-mcp-client.ts","lineNumber":118,"sourceCode":"  if (connection.authorization.type === \"api-key\" && !connection.authorization.token.trim()) {\n    throw new Error(\"An API key connection requires a non-empty token.\")\n  }\n  const url = new URL(parsed.serverUrl)\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"An enterprise MCP server URL must use HTTP or HTTPS.\")\n  }\n  if (url.username || url.password) {\n    throw new Error(\"An enterprise MCP server URL cannot contain embedded credentials.\")\n  }\n  if (url.hash) throw new Error(\"An enterprise MCP server URL cannot contain a fragment.\")\n  return url\n}\n\nfunction validateRedirectUri(redirectUri: string): string {\n  const parsed = redirectUriSchema.parse(redirectUri)\n  const url = new URL(parsed)\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"An enterprise MCP OAuth redirect URI must use HTTP or HTTPS.\")\n  }\n  if (url.username || url.password || url.hash) {\n    throw new Error(\"An enterprise MCP OAuth redirect URI cannot contain credentials or a fragment.\")\n  }\n  return parsed\n}\n\nfunction configurationValue<T>(parse: () => T): T {\n  try {\n    return parse()\n  } catch (error) {\n    throw new EnterpriseMcpClientError({\n      operationPhase: \"configuration\",\n      requestPhase: null,\n      cause: error,\n    })\n  }\n}","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/packages/enterprise-mcp-client/src/enterprise-mcp-client.ts#L100-L136","documentation":"validateRedirectUri in packages/enterprise-mcp-client/src/enterprise-mcp-client.ts throws when the OAuth redirect URI uses a scheme other than http: or https:. Redirect URIs are registered with the authorization server and resolved by the browser, so the library enforces HTTP(S) (native apps typically use a loopback http://127.0.0.1 URI).","triggerScenarios":"Passing a redirect URI like \"myapp://oauth/callback\", \"com.example.app:/oauth\", or any custom-scheme URI to the client's OAuth/authorization setup.","commonSituations":"Porting a mobile/native OAuth config that used custom URL schemes into this client; copying a redirect URI from another OAuth library that accepted arbitrary schemes.","solutions":["Use an http(s) redirect URI, e.g. http://127.0.0.1:<port>/callback for native apps or an https:// URL for web apps.","Register the HTTP(S) loopback redirect with the authorization server and use it in the client configuration.","If a custom scheme is required by your platform, handle the OAuth flow outside this client or front it with a local loopback listener."],"exampleFix":"// before\nredirectUri: \"com.myapp://oauth/callback\"\n\n// after\nredirectUri: \"http://127.0.0.1:8765/callback\"","handlingStrategy":"validation","validationCode":"function assertHttpRedirectUri(redirectUri: string) {\n  const u = new URL(redirectUri)\n  if (u.protocol !== \"https:\" && u.protocol !== \"http:\") {\n    throw new Error(`redirectUri must be http(s), got ${u.protocol}`)\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["For native apps, standardize on http://127.0.0.1:<port>/callback loopback redirects","Register exactly the same redirect string with the authorization server","Do not reuse custom-scheme configs from mobile OAuth libraries"],"tags":["oauth","redirect-uri","validation","configuration"],"backgroundTag":"invalid-redirect-uri","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}