MCP over HTTP: validating OAuth tokens isn't enough—check the audience claim
alvelda · x · 2026-11-05
When running an MCP server over HTTP with OAuth, checking that a token is valid is not sufficient: you must also verify it was issued for your server (the audience claim). Otherwise, a token minted for some other app on the same identity provider will get in.
It's a classic confused-deputy pitfall that MCP server developers should guard against by enforcing the aud claim in their auth logic.
Related event: MCP over HTTP exposes OAuth audience validation flaw(2 posts)→
More from coding & agent
- Revolut cut AI coding inference costs ~90% by self-hosting GLM on 56 B200s instead of Claude — sebkrier · 2026-11-05
- Developers say computer use is where Codex now leaves Claude Code far behind — signulll · 2026-11-05
- VibeCoding a 3D fishing game in 4 days with Kimi K3.1 Pro and DeepSeek: full workflow breakdown — lxfater · 2026-11-05
- Sentry founder says AI agent 'junior' handles hardest coding tasks well — zeeg · 2026-11-05
- How Codex Happened: Inside OpenAI's coding comeback from failed launch to ChatGPT centerpiece — danshipper · 2026-11-05
- Tencent Hunyuan Hy4 lands in OpenClaw with vision, 1M-token context, agent gains — TencentHunyuan · 2026-11-05