fix(security): prevent unauthorized OAuth consent approval via HTTP

The /oauth/consent/approve HTTP endpoint was publicly accessible on
localhost:45818 with no authentication, allowing any local process
(including malicious scripts) to auto-approve MCP client authorization
requests without user interaction. This is how clients like Cursor
could bypass the deep-link consent flow entirely.

Changes:
- Remove /oauth/consent/approve HTTP endpoint from production router
  (consent now exclusively via Tauri IPC command)
- Add cryptographic consent_token to PendingAuthorization, generated
  per-request and shared only via Tauri IPC (get_pending_consent) —
  must be returned on approval to prove legitimacy
- Add 2-second UI cooldown on Approve button to prevent programmatic
  instant approval
- Add per-path rate limiting middleware on OAuth endpoints
  (authorize, token, register, clients)
- Guard approve_oauth_client Tauri command behind MCPMUX_E2E_TEST
  env var (was unrestricted "for E2E testing")
- Conditionally re-enable HTTP consent endpoint only when
  MCPMUX_E2E_TEST=1 for E2E test compatibility

Signed-off-by: Claude <noreply@anthropic.com>

https://claude.ai/code/session_019gtFefwPpKWZH73DEyUpE2
Signed-off-by: Claude <noreply@anthropic.com>

Author: claude

apps/desktop/src-tauri/src/commands/oauth.rs

@@ -74,6 +74,10 @@ pub struct ConsentRequestDetails {
     pub state: Option<String>,
     /// When this request expires (Unix timestamp)
     pub expires_at: i64,
+    /// Cryptographic consent token (shared only via this IPC call, never over HTTP).
+    /// Must be returned in the approval request to prove the caller is the
+    /// legitimate desktop app UI—not an external script or bot.
+    pub consent_token: String,
 }
 
 /// Handle an incoming deep link URL
@@ -360,6 +364,16 @@ pub async fn get_pending_consent(
         return Err(ConsentError::expired(&request_id));
     }
 
+    // Extract consent_token (required for security—ensures only the desktop
+    // app that retrieved this token via IPC can approve the request)
+    let consent_token = auth.consent_token.clone().ok_or_else(|| {
+        error!("[OAuth] Pending authorization missing consent_token");
+        ConsentError {
+            code: "NOT_FOUND".to_string(),
+            message: "Authorization request is missing consent token — it may have been created before this security update. Please retry.".to_string(),
+        }
+    })?;
+
     // Build response with authoritative data from backend
     // The client_name here comes from our database lookup in handlers.rs
     let details = ConsentRequestDetails {
@@ -373,6 +387,7 @@ pub async fn get_pending_consent(
         scope: auth.scope.clone().unwrap_or_default(),
         state: auth.state.clone(),
         expires_at: auth.expires_at,
+        consent_token,
     };
 
     info!(
@@ -390,6 +405,9 @@ pub struct ConsentApprovalRequest {
     pub request_id: String,
     /// Whether the user approved the request
     pub approved: bool,
+    /// Cryptographic consent token (must match the one issued via get_pending_consent).
+    /// This proves the caller obtained the token through Tauri IPC, not HTTP scraping.
+    pub consent_token: String,
     /// Optional alias name for the client
     pub client_alias: Option<String>,
     /// Connection mode: "follow_active", "locked", or "ask_on_change"
@@ -453,6 +471,27 @@ pub async fn approve_oauth_consent(
         });
     };
 
+    // Validate consent_token: proves the caller obtained this token via Tauri
+    // IPC (get_pending_consent), not by scraping the HTTP authorization page.
+    match &pending.consent_token {
+        Some(expected_token) => {
+            if request.consent_token != *expected_token {
+                error!(
+                    "[OAuth] Consent token mismatch for request_id: {} — possible unauthorized approval attempt",
+                    request.request_id
+                );
+                return Err("Invalid consent token".to_string());
+            }
+        }
+        None => {
+            error!(
+                "[OAuth] Pending authorization missing consent_token for request_id: {}",
+                request.request_id
+            );
+            return Err("Consent token not available".to_string());
+        }
+    }
+
     // Remove the pending authorization (it's been processed)
     {
         let mut state = gw_state.write().await;
@@ -504,6 +543,7 @@ pub async fn approve_oauth_consent(
             code_challenge: pending.code_challenge.clone(),
             code_challenge_method: pending.code_challenge_method.clone(),
             expires_at: code_expires_at,
+            consent_token: None, // Auth code entries don't need consent tokens
         };
 
         state.store_pending_authorization(&code, new_pending);
@@ -656,13 +696,19 @@ pub async fn get_oauth_clients(
     Ok(client_infos)
 }
 
-/// Approve a registered OAuth client by ID (for E2E testing).
-/// In production, clients are approved via the consent flow.
+/// Approve a registered OAuth client by ID (for E2E testing only).
+///
+/// Guarded by the `MCPMUX_E2E_TEST` environment variable. In production
+/// builds this command is a no-op that returns an error.
 #[tauri::command]
 pub async fn approve_oauth_client(
     client_id: String,
     gateway_state: State<'_, Arc<RwLock<GatewayAppState>>>,
 ) -> Result<(), String> {
+    if std::env::var("MCPMUX_E2E_TEST").is_err() {
+        return Err("approve_oauth_client is only available in E2E test mode".to_string());
+    }
+
     let app_state = gateway_state.read().await;
     let Some(ref gw_state) = app_state.gateway_state else {
         return Err("Gateway not running".to_string());
@@ -674,7 +720,10 @@ pub async fn approve_oauth_client(
     repo.approve_client(&client_id)
         .await
         .map_err(|e| format!("Failed to approve client: {}", e))?;
-    info!("[OAuth] Approved client via test command: {}", client_id);
+    info!(
+        "[OAuth] Approved client via E2E test command: {}",
+        client_id
+    );
     Ok(())
 }
 

apps/desktop/src/components/OAuthConsentModal.tsx

@@ -57,6 +57,8 @@ interface ConsentRequestDetails {
   scope: string;
   state: string | null;
   expiresAt: number;
+  /** Cryptographic token shared only via Tauri IPC—must be sent back on approval */
+  consentToken: string;
 }
 
 /** Error from get_pending_consent */
@@ -124,6 +126,8 @@ export function OAuthConsentModal() {
   const [spaces, setSpaces] = useState<Space[]>([]);
   const [isProcessing, setIsProcessing] = useState(false);
   const [processError, setProcessError] = useState<string | null>(null);
+  /** 2-second cooldown before the Approve button becomes active */
+  const [approveReady, setApproveReady] = useState(false);
 
   // Load spaces when modal opens
   useEffect(() => {
@@ -132,6 +136,17 @@ export function OAuthConsentModal() {
     }
   }, [modalState.type]);
 
+  // 2-second cooldown: prevents instant automated approval by requiring the
+  // consent modal to be visible for at least 2 seconds before Approve is active.
+  useEffect(() => {
+    if (modalState.type === 'consent') {
+      setApproveReady(false);
+      const timer = setTimeout(() => setApproveReady(true), 2000);
+      return () => clearTimeout(timer);
+    }
+    setApproveReady(false);
+  }, [modalState.type]);
+
   useEffect(() => {
     // Listen for OAuth consent requests from the backend (deep link)
     const unlisten = listen<OAuthDeepLinkPayload>('oauth-consent-request', async (event) => {
@@ -178,6 +193,7 @@ export function OAuthConsentModal() {
         request: {
           request_id: details.requestId,
           approved: true,
+          consent_token: details.consentToken,
           client_alias: clientAlias || null,
           connection_mode: connectionMode,
           locked_space_id: connectionMode === 'locked' ? lockedSpaceId : null,
@@ -211,6 +227,7 @@ export function OAuthConsentModal() {
         request: {
           request_id: details.requestId,
           approved: false,
+          consent_token: details.consentToken,
           client_alias: null,
         },
       });
@@ -467,14 +484,14 @@ export function OAuthConsentModal() {
               variant="primary"
               className="flex-1"
               onClick={handleApprove}
-              disabled={isProcessing}
+              disabled={isProcessing || !approveReady}
             >
               {isProcessing ? (
                 <div className="h-4 w-4 mr-2 animate-spin rounded-full border-2 border-current border-t-transparent" />
               ) : (
                 <Check className="h-4 w-4 mr-2" />
               )}
-              Approve
+              {approveReady ? 'Approve' : 'Approve (wait...)'}
             </Button>
           </div>
 

crates/mcpmux-gateway/src/server/handlers.rs

@@ -136,6 +136,11 @@ pub struct PendingAuthorization {
     pub code_challenge_method: Option<String>,
     /// Unix timestamp when this request expires
     pub expires_at: i64,
+    /// Consent token: cryptographic secret shared only via Tauri IPC.
+    /// Prevents any process from approving consent via HTTP without going
+    /// through the desktop app UI. Only present on initial consent requests
+    /// (not on auth-code entries used for token exchange).
+    pub consent_token: Option<String>,
 }
 
 /// OAuth authorization endpoint
@@ -272,6 +277,18 @@ pub async fn oauth_authorize(
         .map(|d| d.as_secs() as i64 + 300) // 5 minutes
         .unwrap_or(i64::MAX);
 
+    // Generate consent_token: a cryptographic secret shared only via Tauri IPC.
+    // This prevents any external process from approving consent by calling an
+    // HTTP endpoint directly—only the desktop app UI that retrieves this token
+    // via get_pending_consent can submit a valid approval.
+    let consent_token = {
+        use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
+        let mut bytes = [0u8; 32];
+        use rand::RngCore;
+        rand::thread_rng().fill_bytes(&mut bytes);
+        URL_SAFE_NO_PAD.encode(bytes)
+    };
+
     {
         let mut gateway_state = state.write().await;
         gateway_state.store_pending_authorization(
@@ -285,6 +302,7 @@ pub async fn oauth_authorize(
                 code_challenge: params.code_challenge.clone(),
                 code_challenge_method: params.code_challenge_method.clone(),
                 expires_at,
+                consent_token: Some(consent_token),
             },
         );
     }
@@ -850,6 +868,7 @@ pub async fn oauth_consent_approve(
                 code_challenge: pending.code_challenge.clone(),
                 code_challenge_method: pending.code_challenge_method.clone(),
                 expires_at: code_expires_at,
+                consent_token: None, // Auth code entries don't need consent tokens
             },
         );
 

crates/mcpmux-gateway/src/server/mod.rs

@@ -7,6 +7,7 @@
 mod dependencies;
 mod handlers;
 pub mod logging_middleware;
+pub mod rate_limit;
 mod service_container;
 mod startup;
 mod state;
@@ -301,10 +302,10 @@ impl GatewayServer {
             // Fallback for clients that don't fetch metadata (VS Code default behavior)
             .route("/authorize", get(handlers::oauth_authorize))
             .route("/oauth/token", post(handlers::oauth_token))
-            .route(
-                "/oauth/consent/approve",
-                post(handlers::oauth_consent_approve),
-            )
+            // NOTE: /oauth/consent/approve was removed for security.
+            // Consent approval now happens exclusively via Tauri IPC command
+            // (approve_oauth_consent), which can only be invoked by the desktop
+            // app's own WebView—not by external HTTP clients, scripts, or bots.
             // Client registration (DCR - public)
             .route("/oauth/register", post(handlers::oauth_register))
             // Client management (for desktop app)
@@ -317,7 +318,22 @@ impl GatewayServer {
             .route(
                 "/oauth/clients/{client_id}",
                 delete(handlers::oauth_delete_client),
-            )
+            );
+
+        // E2E test mode: re-enable HTTP consent endpoint (guarded by env var).
+        // In production this endpoint does NOT exist—consent is Tauri-IPC-only.
+        if std::env::var("MCPMUX_E2E_TEST").is_ok() {
+            warn!("[Gateway] E2E test mode: /oauth/consent/approve HTTP endpoint enabled");
+            router = router.route(
+                "/oauth/consent/approve",
+                post(handlers::oauth_consent_approve),
+            );
+        }
+
+        // Rate limiter for OAuth endpoints (prevents abuse / consent flooding)
+        let rate_limiter = rate_limit::default_oauth_rate_limiter();
+
+        let mut router = router
             // Protected MCP routes (using rmcp's StreamableHttpService)
             .merge(mcp_routes)
             // Client features (needs services)
@@ -328,7 +344,10 @@ impl GatewayServer {
             // Request/Response logging with body (DEBUG level)
             .layer(middleware::from_fn(
                 logging_middleware::http_logging_middleware,
-            ));
+            ))
+            // Rate limiting on OAuth endpoints
+            .layer(axum::Extension(rate_limiter))
+            .layer(middleware::from_fn(rate_limit::rate_limit_middleware));
 
         // Add CORS if enabled
         if self.config.enable_cors {