fix(auth): change default client_secret expiry from 30 days to no expiration #1312
Conversation
…ion) The 30-day default caused MCP clients to fail with "Client secret has expired" after 30 days. Aligns with Python SDK behavior (defaults to None). - undefined: omit client_secret_expires_at (no expiry) - 0: set to 0 (no expiry per RFC 7591) - positive: set to now + seconds
commit: |
felixweinberger
left a comment
felixweinberger
left a comment
There was a problem hiding this comment.
It's true that this aligns behavior with Python which defaults to None:
See: https://github.com/modelcontextprotocol/python-sdk/blob/8ac0cab98c3243e3369e283ddf4cee5c2d63629b/src/mcp/server/auth/settings.py#L6, and https://github.com/modelcontextprotocol/python-sdk/blob/8ac0cab98c3243e3369e283ddf4cee5c2d63629b/src/mcp/server/auth/handlers/register.py#L97-L101
However - the actual RFC suggests that client_secret_expires_at is REQUIRED if client_secret is issued, with 0 meaning "no expiry":
Source: https://www.rfc-editor.org/rfc/rfc7591.html#section-3.2.1
That suggests to me we should actually be tightening up the Python SDK to have a default.
Debatable whether the default should be 30 days though - maybe that's the right thing to align on here - will defer to @pcarleton who has more context on auth here.
| // - undefined: omit client_secret_expires_at (no expiration) | ||
| // - 0: set to 0 (no expiration per RFC 7591) | ||
| // - positive number: set to now + seconds | ||
| let clientSecretExpiresAt: number | undefined; | ||
| if (!isPublicClient) { | ||
| if (clientSecretExpirySeconds !== undefined && clientSecretExpirySeconds > 0) { | ||
| clientSecretExpiresAt = clientIdIssuedAt + clientSecretExpirySeconds; | ||
| } else if (clientSecretExpirySeconds === 0) { | ||
| clientSecretExpiresAt = 0; | ||
| } | ||
| // else: undefined - omit from response (no expiration) | ||
| } |
There was a problem hiding this comment.
nit: these comments don't add a ton of value imo, would remove
2 participants
The 30-day default for
clientSecretExpirySecondscaused production issues where MCP clients fail with "Client secret has expired" after 30 days.Motivation and Context
MCP servers using the SDK's default settings issue client secrets that expire in 30 days. Some MCP clients (e.g., ChatGPT certified connectors) don't automatically re-register when secrets expire, causing users to see cryptic "invalid_client: Client secret has expired" errors.
This change aligns TypeScript SDK with Python SDK behavior, which defaults to
None(no expiration). Per RFC 7591,client_secret_expires_atis optional - servers that want expiring secrets can still explicitly setclientSecretExpirySeconds.How Has This Been Tested?
Breaking Changes
None. This is a relaxation of default behavior:
clientSecretExpirySecondsworks unchangedTypes of changes
Checklist
Additional context
Behavior after this change:
clientSecretExpirySecondsclient_secret_expires_atundefined(new default)00(no expiry per RFC 7591)> 0now + secondsRelated: Python SDK already defaults to
Noneinsrc/mcp/server/auth/settings.py