Vibe Coding
MCP's OAuth Overhaul: RFC 9207 Issuer Validation, application_type in DCR, and a Push Toward CIMD
Duende's July 30 breakdown covers six authorization-hardening SEPs in the 2026-07-28 spec. SEP-2468 requires the `iss` parameter in OAuth authorization responses per RFC 9207, defending against mixup attacks where a client talks to multiple authorization servers and one is attacker-controlled. SEP-837 has AS operators validate redirect URIs via `application_type` (web clients must use HTTPS; native apps may use HTTP only on localhost), and SEP-2352 requires separate credentials per authorization server. Duende notes IdentityServer deployments need no changes for several SEPs since issuer identification is already default, and flags the broader shift from Dynamic Client Registration toward Client ID Metadata Documents.
↳ Follow the thread