Authorization changedspecification/2026-07-28/basic/authorization/index
Nearest release: v2.1.284, published 4 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+11added
Lines−11removed
From line
193
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits3to this page, all time
The whole hunk
from line 193, old and new numbered
/
from line 193
193193
194194On receiving the authorization response, MCP clients **MUST** apply the validation in [RFC9207 Section 2.4](https://datatracker.ietf.org/doc/html/rfc9207#section-2.4) before transmitting the authorization code to any token endpoint:
195195
196| `authorization_response_iss_parameter_supported` | `iss` in response | Client action |
197| ------------------------------------------------ | ----------------- | ------------------------------------------------------------------------------------------ |
198| `true` | present | Compare to the recorded issuer using simple string comparison ([RFC3986 Section 6.2.1][1]) |
199| `true` | absent | Reject the response |
200| `false` or absent | present | Compare to the recorded issuer using simple string comparison ([RFC3986 Section 6.2.1][1]) |
201| `false` or absent | absent | Proceed |
196| `authorization_response_iss_parameter_supported` | `iss` in response | Client action |
197| - | - | - |
198| `true` | present | Compare to the recorded issuer using simple string comparison ([RFC3986 Section 6.2.1][1]) |
199| `true` | absent | Reject the response |
200| `false` or absent | present | Compare to the recorded issuer using simple string comparison ([RFC3986 Section 6.2.1][1]) |
201| `false` or absent | absent | Proceed |
202202
203203[1]: https://datatracker.ietf.org/doc/html/rfc3986#section-6.2.1
204204
from line 314
314314
315315Servers **MUST** return appropriate HTTP status codes for authorization errors:
316316
317| Status Code | Description | Usage |
318| ----------- | ------------ | ------------------------------------------ |
319| 401 | Unauthorized | Authorization required or token invalid |
320| 403 | Forbidden | Invalid scopes or insufficient permissions |
321| 400 | Bad Request | Malformed authorization request |
317| Status Code | Description | Usage |
318| - | - | - |
319| 401 | Unauthorized | Authorization required or token invalid |
320| 403 | Forbidden | Invalid scopes or insufficient permissions |
321| 400 | Bad Request | Malformed authorization request |
322322
323323### Scope Challenge Handling
324324
No line in this hunk matches that.