fix: Include pathname in resourceServer for RFC 8707 path-aware audience validation

[bokhi]

Fixes #108

Problem

When using RFC 8707 Resource Indicators with path components (e.g., resource=https://example.com/api), token validation fails with:

invalid_token: Token audience does not match resource server

This breaks OAuth flows for services like ChatGPT custom connectors.

Root Cause

In handleApiRequest, the resourceServer is computed using only the origin:

const resourceServer = `${requestUrl.protocol}//${requestUrl.host}`;

However, RFC 8707 recommends using full URLs with paths for resource indicators. Since audienceMatches performs strict equality (===):

• Token audience: https://example.com/api (from authorization request's resource parameter)
• Resource server: https://example.com (computed from request URL)
• Result: mismatch → validation fails

Solution

This PR updates the resourceServer computation in both internal and external token validation flows to include the pathname component:

const resourceServer = `${requestUrl.protocol}//${requestUrl.host}${requestUrl.pathname}`;

Changes

• src/oauth-provider.ts line 2194: Include pathname in resourceServer (internal token validation)
• src/oauth-provider.ts line 2228: Include pathname in resourceServer (external token validation)

Testing

Tested with ChatGPT custom connector:

• ✅ Authorization flow with resource=https://server/mcp
• ✅ Token issued with aud: "https://server/mcp"
• ✅ API request to https://server/mcp succeeds
• ✅ Audience validation passes

References

• RFC 8707: Resource Indicators for OAuth 2.0
• Section 2: "The value of the 'resource' parameter MUST be an absolute URI"
• Section 3.1: "The authorization server MUST set the 'aud' claim to the resource value"

[changeset-bot]

⚠️ No Changeset found

Latest commit: 249513a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/workers-oauth-provider/@cloudflare/workers-oauth-provider@109

commit: 5d65326