Skip to main content

Definition

Assembly: Microsoft.OData.Mcp.Authentication.dll Namespace: Microsoft.OData.Mcp.Authentication.Outbound Inheritance: System.Object

Syntax

Summary

The RFC 8252 loopback redirect endpoint the authorization code grant hands to the authorization server: an HttpListener bound to http://127.0.0.1:{ephemeral}/callback/ that accepts exactly one authorization response, binds it to the expected state, and hands back the SDK AuthorizationResult.

Remarks

The default host is the literal 127.0.0.1 and never localhost, per specs/v3/AUTHENTICATION.md “Security & Privacy”: a DNS name can resolve somewhere else and a second process listening on the same name would be handed the authorization code. The port is chosen by binding a TcpListener to port zero and reading back what the operating system assigned, so two concurrent sign-ins never collide. Per AUTH-12 nothing here logs, echoes, or renders the code: the browser page says only that the window can be closed.

Examples

Constructors

.ctor Inherited

Inherited from object

Syntax

Properties

RedirectUri

Gets the absolute redirect URI this instance is listening on, which is exactly the redirect_uri the authorization request and the token request must both carry.

Syntax

Property Value

Type: System.Uri

Methods

Dispose

Syntax

Remarks

Idempotent: a callback whose CancellationToken) already ran is disposed a second time by the caller’s using without error.

Equals Inherited Virtual

Inherited from object

Syntax

Parameters

Returns

Type: bool

Equals Inherited

Inherited from object

Syntax

Parameters

Returns

Type: bool

GetHashCode Inherited Virtual

Inherited from object

Syntax

Returns

Type: int

GetType Inherited

Inherited from object

Syntax

Returns

Type: System.Type

MemberwiseClone Inherited

Inherited from object

Syntax

Returns

Type: object

ReferenceEquals Inherited

Inherited from object

Syntax

Parameters

Returns

Type: bool

Start

Binds a loopback listener for the authorization response and starts accepting connections.

Syntax

Parameters

Returns

Type: Microsoft.OData.Mcp.Authentication.Outbound.LoopbackAuthorizationCallback A started callback whose LoopbackAuthorizationCallback.RedirectUri is the effective redirect URI.

Exceptions

Examples

Remarks

The free port is discovered by binding a TcpListener to port zero and immediately releasing it, then handing that port to HttpListener. A bind failure — an override naming a port another process already owns, or a platform where HttpListener needs a URL reservation — fails first here with the prefix in the message, rather than half way through a sign-in the operator has already started in a browser. An override is also held to the RFC 8252 section 7.3 policy this class exists to implement: it must be http on 127.0.0.1, localhost, or ::1. A public https redirect cannot be listened on here at all, and accepting one would leave the operator waiting on a listener the authorization server is never going to reach.

ToString Inherited Virtual

Inherited from object

Syntax

Returns

Type: string?

WaitAsync

Accepts exactly one authorization response, validates its state, and returns the SDK result the token exchange runs on.

Syntax

Parameters

Returns

Type: System.Threading.Tasks.Task<ModelContextProtocol.Authentication.AuthorizationResult> The authorization response’s code, state, and RFC 9207 iss.

Exceptions

Examples

Remarks

The listener is closed before this method returns or throws, so a mismatched state — the loopback CSRF case — leaves no socket a second attacker could reach. The comparison is Ordinal on the whole value: a prefix match would defeat the point of binding the request to the response.
  • System.IDisposable