feat: add allowlist for private-use redirect URI schemes (RFC 8252 §7.1) with cursor:// as initial entry

[Pratham-Mishra04]

Summary

Adds a default-deny allowlist for private-use ("custom") URI schemes in OAuth2 redirect URI validation, enabling native app clients like Cursor to use schemes such as cursor://anysphere.cursor-mcp/oauth/callback (per RFC 8252 §7.1) without opening the door to dangerous schemes like javascript:, data:, or file:.

Changes

• Introduced allowedPrivateUseRedirectSchemes, a map-based allowlist of permitted private-use URI schemes. Currently contains cursor as the only entry.
• Updated isAllowedRedirectScheme to accept URIs whose scheme appears in the allowlist, provided the URI also includes an authority component (scheme://host/...). Opaque forms such as cursor:whatever are still rejected.
• Added TestPrivateUseRedirectSchemes covering allowlisted schemes, loopback/https cases, non-allowlisted custom schemes, and dangerous schemes to ensure the default-deny behavior holds.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

go test ./transports/bifrost-http/handlers/...

Expected: all tests pass, including the new TestPrivateUseRedirectSchemes test which validates that:

• cursor://anysphere.cursor-mcp/oauth/callback is accepted
• https://example.com/cb and http://127.0.0.1:49152/cb are accepted
• com.example.app://oauth/callback, myapp://callback, vscode://callback are rejected
• javascript:, data:, file:, and opaque forms of allowlisted schemes are rejected

Breaking changes

• Yes
• No

Security considerations

The allowlist is intentionally default-deny. Only schemes explicitly added to allowedPrivateUseRedirectSchemes are permitted beyond https and http-loopback. An authority component is required even for allowlisted schemes, preventing opaque URI forms from being written into a Location header. Dangerous schemes (javascript:, data:, file:) remain rejected regardless of any allowlist entry. New native app clients requiring a custom scheme must be explicitly added to the allowlist.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Pratham-Mishra04]

• feat: detect and revoke OAuth2 token families on authorization code replay (RFC 6749 §4.1.2) #4996
• feat: add shouldSweep gate to OAuth2 sweep worker and expose StartOAuth2SweepWorker #4995
• feat: add allowlist for private-use redirect URI schemes (RFC 8252 §7.1) with cursor:// as initial entry #4994 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a97e4f75-32c7-413f-a65c-63274dfb5744

📥 Commits

Reviewing files that changed from the base of the PR and between 5b32a70 and 51c8c10.

📒 Files selected for processing (2)

• transports/bifrost-http/handlers/localhostcheck_test.go
• transports/bifrost-http/handlers/mcpoauth2issuance.go

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Tightened redirect URI scheme validation to default-deny all non-https/non-http schemes, while allowing an approved private-use scheme when used in a full scheme://host/... (authority-form) format.
  • Continued to allow https universally, http only for loopback, and rejected unsafe/opaque or malformed private-use variants.
• Tests
  • Added coverage for private-use scheme allowance/denial and for redirect URI matching, including mismatches and cases involving ports and incorrect structure.

Walkthrough

Adds a deny-by-default allowlist for private-use redirect URI schemes in isAllowedRedirectScheme, requires authority-form private-use URIs, and extends tests for allow/deny and redirect matching behavior.

Changes

Private-use Redirect Scheme Validation

Layer / File(s)	Summary
Allowlist and validation logic transports/bifrost-http/handlers/mcpoauth2issuance.go	Adds allowedPrivateUseRedirectSchemes and updates isAllowedRedirectScheme to deny non-https/http schemes not in the allowlist, and to require a non-empty Host for allowlisted private-use schemes.
Test coverage for scheme validation transports/bifrost-http/handlers/localhostcheck_test.go	Adds tests covering isAllowedRedirectScheme allow/deny cases and matchRedirectURI behavior for registered private-use redirect URIs, including exact matches and mismatches.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• maximhq/bifrost#4523: Adds redirect-URI matching tests in the same handler area and exercises related matching behavior.

Suggested reviewers: akshaydeo, danpiths, roroghost17

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding a private-use redirect URI allowlist with cursor:// as the initial entry.
Description check	✅ Passed	The PR description is mostly complete and covers summary, changes, testing, type, security, and checklist; only related issues/screenshots are omitted.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 07-07-feat_adds_support_for_cursor_scheme_in_mcp_oauth

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

Safe to merge — the allowlist logic is correct, the authority-component guard prevents opaque-form bypass, and the matching path for private-use scheme URIs falls into the existing exact-match branch without touching loopback logic.

The scheme validation correctly gates registration on both allowlist membership and the presence of an authority component, blocking opaque forms like cursor:whatever. The matchRedirectURI function requires an exact string match for non-loopback hosts, so a registered cursor:// URI cannot be reached by a differently-hosted candidate. Both new test functions cover the critical boundary cases. The previously flagged stale comment and error message are cosmetic and were noted in an earlier review round.

The inline comment and error message in mcpoauth2issuance.go around lines 87–92 remain stale from a prior review; no files require blocking attention for this change.

Important Files Changed

Filename	Overview
transports/bifrost-http/handlers/mcpoauth2issuance.go	Adds allowedPrivateUseRedirectSchemes allowlist and updates isAllowedRedirectScheme; logic is correct but the inline comment and error message at lines 87–92 are now stale (noted in a prior review round).
transports/bifrost-http/handlers/localhostcheck_test.go	Adds TestPrivateUseRedirectSchemes and TestMatchRedirectURIPrivateUseSchemes; both requested by prior review and now present with thorough case coverage.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Registration Request\nredirect_uri provided] --> B[isAllowedRedirectScheme]
    B --> C{scheme?}
    C -- https --> D[Allow ✓]
    C -- http --> E{isLoopbackRedirectHost?}
    E -- yes --> D
    E -- no --> F[Reject ✗]
    C -- other --> G{in allowedPrivateUseRedirectSchemes?}
    G -- no --> F
    G -- yes --> H{parsed.Host != empty?}
    H -- no\nopaque form --> F
    H -- yes\nauthority present --> D
    D --> I[URI stored in registration]
    J[Authorization Request\nredirect_uri candidate] --> K[matchRedirectURI]
    K --> L{isLoopback host?}
    L -- yes --> M[Match scheme + path\nignore port]
    L -- no --> N[Exact string match]
    M --> O{match found?}
    N --> O
    O -- yes --> P[Allow redirect ✓]
    O -- no --> Q[Reject ✗]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Registration Request\nredirect_uri provided] --> B[isAllowedRedirectScheme]
    B --> C{scheme?}
    C -- https --> D[Allow ✓]
    C -- http --> E{isLoopbackRedirectHost?}
    E -- yes --> D
    E -- no --> F[Reject ✗]
    C -- other --> G{in allowedPrivateUseRedirectSchemes?}
    G -- no --> F
    G -- yes --> H{parsed.Host != empty?}
    H -- no\nopaque form --> F
    H -- yes\nauthority present --> D
    D --> I[URI stored in registration]
    J[Authorization Request\nredirect_uri candidate] --> K[matchRedirectURI]
    K --> L{isLoopback host?}
    L -- yes --> M[Match scheme + path\nignore port]
    L -- no --> N[Exact string match]
    M --> O{match found?}
    N --> O
    O -- yes --> P[Allow redirect ✓]
    O -- no --> Q[Reject ✗]

Loading

_{Reviews (3): Last reviewed commit: "feat: adds support for cursor scheme in ..." | Re-trigger Greptile}

[coderabbitai]

🧹 Nitpick comments (1)

transports/bifrost-http/handlers/mcpoauth2issuance.go (1)

685-690: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value

transports/bifrost-http/handlers/mcpoauth2issuance.go:685-690 — Allow RFC 8252 private-use redirects by URI shape, not host presence. parsed.Host != "" rejects reverse-domain redirects like com.example.app:/oauth2redirect/callback because url.Parse leaves Host empty for that form. Use parsed.Opaque == "" instead to still reject opaque inputs such as cursor:whatever while accepting the canonical single-slash form.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@transports/bifrost-http/handlers/mcpoauth2issuance.go` around lines 685 -
690, The private-use redirect validation in the parsed URI check is too strict
because `parsed.Host != ""` rejects valid RFC 8252 reverse-domain redirects like
`com.example.app:/oauth2redirect/callback`. Update the logic in the redirect
validation path to allow the canonical single-slash form by checking URI shape
with `parsed.Opaque == ""` while still keeping the allowlisted scheme check in
place, so opaque inputs like `cursor:whatever` remain rejected.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@transports/bifrost-http/handlers/mcpoauth2issuance.go`:
- Around line 685-690: The private-use redirect validation in the parsed URI
check is too strict because `parsed.Host != ""` rejects valid RFC 8252
reverse-domain redirects like `com.example.app:/oauth2redirect/callback`. Update
the logic in the redirect validation path to allow the canonical single-slash
form by checking URI shape with `parsed.Opaque == ""` while still keeping the
allowlisted scheme check in place, so opaque inputs like `cursor:whatever`
remain rejected.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5d1dcab6-3130-4f2e-a4f6-e64a9716526c

📥 Commits

Reviewing files that changed from the base of the PR and between d9577ba and 2a1e1f4.

📒 Files selected for processing (2)

• transports/bifrost-http/handlers/localhostcheck_test.go
• transports/bifrost-http/handlers/mcpoauth2issuance.go

[Pratham-Mishra04]

Merge activity

• Jul 9, 7:20 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 9, 7:20 AM UTC: @Pratham-Mishra04 merged this pull request with Graphite.