Fix OAuth redirect handling in MCP clients (#630)

* Fix OAuth redirect handling in MCP clients

OAuth callbacks with successRedirect/errorRedirect returned 200 OK
instead of 302 redirects because CORS response reconstruction lost
status codes and headers. Relative URLs also failed since
Response.redirect() requires absolute URLs.

Preserve status/statusText when adding CORS headers, use Headers
constructor to properly copy all headers, and leverage URL
constructor to normalize relative URLs to absolute.

* Fix OAuth redirect handling in MCP clients

* Keep upgrade check

Author: ghostwriternr

.changeset/pink-mangos-float.md

@@ -0,0 +1,5 @@
+---
+"agents": patch
+---
+
+Fix OAuth redirect handling in MCP clients

packages/agents/src/index.ts

@@ -1665,20 +1665,25 @@ export class Agent<
       return config.customHandler(result);
     }
 
-    // Use redirect URLs if configured
+    const baseOrigin = new URL(request.url).origin;
+
+    // Redirect to success URL if configured
     if (config?.successRedirect && result.authSuccess) {
-      return Response.redirect(config.successRedirect);
+      return Response.redirect(
+        new URL(config.successRedirect, baseOrigin).href
+      );
     }
 
+    // Redirect to error URL if configured
     if (config?.errorRedirect && !result.authSuccess) {
-      return Response.redirect(
-        `${config.errorRedirect}?error=${encodeURIComponent(result.authError || "Unknown error")}`
-      );
+      const errorUrl = `${config.errorRedirect}?error=${encodeURIComponent(
+        result.authError || "Unknown error"
+      )}`;
+      return Response.redirect(new URL(errorUrl, baseOrigin).href);
     }
 
-    // Default behavior - redirect to base URL
-    const baseUrl = new URL(request.url).origin;
-    return Response.redirect(baseUrl);
+    // Default: redirect to base URL
+    return Response.redirect(baseOrigin);
   }
 }
 
@@ -1755,11 +1760,17 @@ export async function routeAgentRequest<Env>(
     request.headers.get("upgrade")?.toLowerCase() !== "websocket" &&
     request.headers.get("Upgrade")?.toLowerCase() !== "websocket"
   ) {
+    const newHeaders = new Headers(response.headers);
+
+    // Add CORS headers
+    for (const [key, value] of Object.entries(corsHeaders)) {
+      newHeaders.set(key, value);
+    }
+
     response = new Response(response.body, {
-      headers: {
-        ...response.headers,
-        ...corsHeaders
-      }
+      status: response.status,
+      statusText: response.statusText,
+      headers: newHeaders
     });
   }
   return response;