MCP OAuth 2.1: Why Discovery, PKCE, and Audience Binding Are Non-Negotiable

·1 views

A technical deep-dive published on DEV Community outlines the critical security gaps in most Model Context Protocol (MCP) OAuth 2.1 implementations. The guide explains that MCP servers must serve protected resource metadata at a well-known endpoint so clients can dynamically discover the correct authorization server, rather than relying on hardcoded configurations. PKCE is mandatory for MCP clients such as CLI tools and desktop apps, which cannot securely store client secrets, and a resource parameter must be included in authorization requests to bind tokens to a specific server audience. Token validation must cover four checks — signature, audience claim, expiry, and scope — since skipping any one of them can enable cross-server token replay or unauthorized access in multi-tenant deployments. The article argues that implementations skipping these steps may appear functional in demos but introduce serious data-leak risks in production environments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

git-bug Shows How Git Refs Can Store Arbitrary Data Without a Database

The open-source tool git-bug, which recently trended on Hacker News, stores bug-tracking data entirely inside a Git repository using custom refs, requiring no external server or database. Each issue is represented as a ref under refs/bugs/, with every change — such as comments or label updates — recorded as a new JSON-based commit linked to its predecessor. This approach leverages Git's built-in content-addressable object store, replication, and deduplication capabilities, effectively turning it into a lightweight event-log database. Developers can apply the same technique to store CI metadata, review notes, audit logs, or deploy configs tied to specific commits using standard Git plumbing commands. The method also supports optimistic locking via git update-ref's compare-and-swap parameter, and data can be synced to remotes by explicitly declaring custom refspecs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kubernetes App Slowness Traced to Redis Queue Blocking, Not Infrastructure

A developer deploying a voting app on AWS EKS via Terraform and Kubernetes noticed intermittent response times ranging from under a second to 60 seconds, despite all pods showing healthy. Initial suspects like AWS Classic ELB warm-up and DNS propagation were ruled out using curl's timing breakdown, which showed TCP connections completing in under 40ms every time. Further testing across three pod replicas revealed the same pod could respond instantly or take nearly a minute, eliminating the theory of a single faulty pod or node. Since all voting pods shared one Redis instance, Redis was inspected next, showing sub-millisecond average command latency. However, the investigation pointed toward Redis's single-threaded command queue as a potential bottleneck, where bursts of commands could cause delays even when individual commands were fast.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer discovers broken payment page after user report surfaces via his own email tool

A developer behind the email tool Premail learned his payment page was returning a 404 error only after a user took the time to submit a comment about it. Despite having automated tests, alerts, and infrastructure monitoring in place, none of the systems caught the broken checkout flow. The issue came to light through Premail's own morning digest feature, which surfaced the user's comment notification and prompted the developer to investigate. He acknowledged the gap in his monitoring, noting that a failed payment can easily be mistaken for a customer simply choosing not to buy. As a gesture of gratitude, he offered the reporting user a 50 percent discount and used the incident to highlight the importance of testing real user-facing flows, not just internal signals.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Benchmark to Test If AI Models Actually Follow Coding Instructions

A developer has created a custom benchmark to evaluate whether AI models can follow specific instructions while completing coding tasks, not just solve the problem itself. The benchmark presents identical prompts to multiple models and checks compliance with constraints such as avoiding certain methods, using a specific language, or returning output in a required format. Each model is scored separately on task correctness and instruction compliance, allowing patterns to emerge across models. The project was motivated by a common frustration: AI often produces technically correct code while ignoring one or more explicit instructions given by the user. The developer plans to expand the benchmark with more complex scenarios, including conflicting instructions, multi-turn tasks, and self-correction after instruction-following errors.

0 comments Read more at DEV Community