Part of #5743 (Workstream C: 2026-07-28 stateless readiness / auth).
Work
Two auth changes in the 2026-07-28 revision, both cheap for us because the hard parts already exist:
- CIMD-first client registration: DCR (RFC 7591) is deprecated in favor of Client ID Metadata Documents. ToolHive already implements CIMD (
pkg/oauthproto/cimd.go, fetch guard, discovery advertisement) — this issue is about ordering/preference: prefer CIMD in the client registration priority chain, de-emphasize DCR in docs/flows, keep DCR for compat.
- RFC 9207 issuer validation: clients MUST validate the
iss authorization-response parameter when present (SEP-2468). Verify our OAuth client flow (pkg/auth/oauth/flow.go) checks it; add if missing.
Also: credentials must be treated as bound to the issuing AS (re-register on AS change, SEP-2352) — verify token/client storage keys on issuer.
Part of #5743 (Workstream C: 2026-07-28 stateless readiness / auth).
Work
Two auth changes in the 2026-07-28 revision, both cheap for us because the hard parts already exist:
pkg/oauthproto/cimd.go, fetch guard, discovery advertisement) — this issue is about ordering/preference: prefer CIMD in the client registration priority chain, de-emphasize DCR in docs/flows, keep DCR for compat.issauthorization-response parameter when present (SEP-2468). Verify our OAuth client flow (pkg/auth/oauth/flow.go) checks it; add if missing.Also: credentials must be treated as bound to the issuing AS (re-register on AS change, SEP-2352) — verify token/client storage keys on issuer.