Definition
Assembly: Microsoft.OData.Mcp.Authentication.dll Namespace: Microsoft.OData.Mcp.Authentication.Outbound Inheritance: System.ObjectSyntax
Summary
The RFC 8252 loopback redirect endpoint the authorization code grant hands to the authorization server: an HttpListener bound tohttp://127.0.0.1:{ephemeral}/callback/ that accepts exactly
one authorization response, binds it to the expected state, and hands back the SDK
AuthorizationResult.
Remarks
The default host is the literal127.0.0.1 and never localhost, per
specs/v3/AUTHENTICATION.md “Security & Privacy”: a DNS name can resolve somewhere else and a
second process listening on the same name would be handed the authorization code. The port is chosen by
binding a TcpListener to port zero and reading back what the operating system assigned, so
two concurrent sign-ins never collide. Per AUTH-12 nothing here logs, echoes, or renders the
code: the browser page says only that the window can be closed.
Examples
Constructors
.ctor Inherited
Inherited from
objectSyntax
Properties
RedirectUri
Gets the absolute redirect URI this instance is listening on, which is exactly theredirect_uri the authorization request and the token request must both carry.
Syntax
Property Value
Type:System.Uri
Methods
Dispose
Syntax
Remarks
Idempotent: a callback whose CancellationToken) already ran is disposed a second time by the caller’susing without error.
Equals Inherited Virtual
Inherited from
objectSyntax
Parameters
Returns
Type:bool
Equals Inherited
Inherited from
objectSyntax
Parameters
Returns
Type:bool
GetHashCode Inherited Virtual
Inherited from
objectSyntax
Returns
Type:int
GetType Inherited
Inherited from
objectSyntax
Returns
Type:System.Type
MemberwiseClone Inherited
Inherited from
objectSyntax
Returns
Type:object
ReferenceEquals Inherited
Inherited from
objectSyntax
Parameters
Returns
Type:bool
Start
Binds a loopback listener for the authorization response and starts accepting connections.Syntax
Parameters
Returns
Type:Microsoft.OData.Mcp.Authentication.Outbound.LoopbackAuthorizationCallback
A started callback whose LoopbackAuthorizationCallback.RedirectUri is the effective redirect URI.
Exceptions
Examples
Remarks
The free port is discovered by binding a TcpListener to port zero and immediately releasing it, then handing that port to HttpListener. A bind failure — an override naming a port another process already owns, or a platform where HttpListener needs a URL reservation — fails first here with the prefix in the message, rather than half way through a sign-in the operator has already started in a browser. An override is also held to the RFC 8252 section 7.3 policy this class exists to implement: it must behttp on 127.0.0.1, localhost, or ::1. A public https redirect
cannot be listened on here at all, and accepting one would leave the operator waiting on a listener
the authorization server is never going to reach.
ToString Inherited Virtual
Inherited from
objectSyntax
Returns
Type:string?
WaitAsync
Accepts exactly one authorization response, validates itsstate, and returns the SDK result
the token exchange runs on.
Syntax
Parameters
Returns
Type:System.Threading.Tasks.Task<ModelContextProtocol.Authentication.AuthorizationResult>
The authorization response’s code, state, and RFC 9207 iss.
Exceptions
Examples
Remarks
The listener is closed before this method returns or throws, so a mismatchedstate — the
loopback CSRF case — leaves no socket a second attacker could reach. The comparison is
Ordinal on the whole value: a prefix match would defeat the point of
binding the request to the response.
Related APIs
- System.IDisposable