Cursor not generating valid Oauth authorization URL

reiarifi · July 24, 2025, 9:33am

Describe the Bug

During MCP Oauth flow, cursor does not populate state and scope parameters in the authorization url.

Steps to Reproduce

Add MCP Server with Oauth Enabled

Response of unauthenticated request:

HTTP/1.1 401 Unauthorized
www-authenticate: Bearer error="invalid_token", error_description="Authentication required", resource_metadata="http://localhost:8001/.well-known/oauth-protected-resource"

Result: Cursor correctly identifies that MCP server requires log in.

Consequence: Cursor retrieves protected resource metadata and authorization server metadata.

GET /.well-known/oauth-protected-resource

{
  "resource": "http://localhost:8001/",
  "authorization_servers": [
    "http://localhost:8001/"
  ],
  "scopes_supported": [
    "openid",
    "email",
    "profile"
  ],
  "bearer_methods_supported": [
    "header"
  ]
}

GET /.well-known/oauth-authorization-server

{
  "issuer": "https://mydomain.okta.com",
  "authorization_endpoint": "https://mydomain.okta.com/oauth2/v1/authorize",
  "token_endpoint": "https://mydomain.okta.com/oauth2/v1/token",
  "registration_endpoint": "http://localhost:8001/oauth/register",
  "response_types_supported": [
    "code",
    "token",
    "id_token",
    "code id_token",
    "code token",
    "id_token token",
    "code id_token token"
  ],
  "response_modes_supported": [
    "query",
    "fragment",
    "form_post",
    "okta_post_message"
  ],
  "grant_types_supported": [
    "authorization_code",
    "implicit",
    "refresh_token",
    "password",
    "client_credentials",
    "urn:ietf:params:oauth:grant-type:device_code",
    "urn:openid:params:grant-type:ciba",
    "urn:okta:params:oauth:grant-type:otp",
    "http://auth0.com/oauth/grant-type/mfa-otp",
    "urn:okta:params:oauth:grant-type:oob",
    "http://auth0.com/oauth/grant-type/mfa-oob"
  ],
  "subject_types_supported": [
    "public"
  ],
  "scopes_supported": [
    "okta.users.manage",
    "okta.users.manage.self",
    "okta.users.read",
    "okta.users.read.self",
    "okta.linkedObjects.manage",
    "okta.linkedObjects.read",
    "okta.profileMappings.manage",
    "okta.profileMappings.read",
    "okta.userTypes.manage",
    "okta.userTypes.read",
    "okta.clients.manage",
    "okta.clients.register",
    "okta.clients.read",
    "okta.appGrants.manage",
    "okta.appGrants.read",
    "okta.policies.manage",
    "okta.policies.read",
    "okta.groups.manage",
    "okta.groups.read",
    "okta.inlineHooks.manage",
    "okta.inlineHooks.read",
    "okta.eventHooks.manage",
    "okta.eventHooks.read",
    "okta.events.read",
    "okta.logs.read",
    "okta.apps.manage",
    "okta.apps.read",
    "okta.schemas.manage",
    "okta.schemas.read",
    "okta.idps.manage",
    "okta.idps.read",
    "okta.factors.manage",
    "okta.factors.read",
    "okta.riskProviders.manage",
    "okta.riskProviders.read",
    "okta.roles.manage",
    "okta.roles.read",
    "okta.orgs.manage",
    "okta.orgs.read",
    "okta.domains.manage",
    "okta.domains.read",
    "okta.brands.manage",
    "okta.brands.read",
    "okta.sessions.manage",
    "okta.sessions.read",
    "okta.templates.manage",
    "okta.templates.read",
    "okta.trustedOrigins.manage",
    "okta.trustedOrigins.read",
    "okta.threatInsights.manage",
    "okta.threatInsights.read",
    "okta.behaviors.manage",
    "okta.behaviors.read",
    "okta.networkZones.manage",
    "okta.networkZones.read",
    "okta.agentPools.manage",
    "okta.agentPools.read",
    "okta.reports.read",
    "okta.features.manage",
    "okta.features.read",
    "okta.certificateAuthorities.manage",
    "okta.certificateAuthorities.read",
    "okta.principalRateLimits.manage",
    "okta.principalRateLimits.read",
    "okta.rateLimits.manage",
    "okta.rateLimits.read",
    "okta.apiTokens.manage",
    "okta.apiTokens.read",
    "okta.personal.adminSettings.manage",
    "okta.personal.adminSettings.read",
    "openid",
    "email",
    "profile",
    "address",
    "phone",
    "offline_access",
    "groups"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "client_secret_jwt",
    "private_key_jwt",
    "none"
  ],
  "claims_supported": [
    "ver",
    "jti",
    "iss",
    "aud",
    "iat",
    "exp",
    "cid",
    "uid",
    "scp",
    "sub"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "introspection_endpoint": "https://mydomain.okta.com/oauth2/v1/introspect",
  "introspection_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "client_secret_jwt",
    "private_key_jwt",
    "none"
  ],
  "revocation_endpoint": "https://mydomain.okta.com/oauth2/v1/revoke",
  "revocation_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "client_secret_jwt",
    "private_key_jwt",
    "none"
  ],
  "end_session_endpoint": "https://mydomain.okta.com/oauth2/v1/logout",
  "request_parameter_supported": true,
  "request_object_signing_alg_values_supported": [
    "HS256",
    "HS384",
    "HS512",
    "RS256",
    "RS384",
    "RS512",
    "ES256",
    "ES384",
    "ES512"
  ],
  "device_authorization_endpoint": "https://mydomain.okta.com/oauth2/v1/device/authorize",
  "pushed_authorization_request_endpoint": "https://mydomain.okta.com/oauth2/v1/par",
  "backchannel_token_delivery_modes_supported": [
    "poll"
  ],
  "backchannel_authentication_request_signing_alg_values_supported": [
    "HS256",
    "HS384",
    "HS512",
    "RS256",
    "RS384",
    "RS512",
    "ES256",
    "ES384",
    "ES512"
  ],
  "dpop_signing_alg_values_supported": [
    "RS256",
    "RS384",
    "RS512",
    "ES256",
    "ES384",
    "ES512"
  ]
}
➜  simple-auth git:(mcp-auth) ✗ (⎈|dataprod-ni-us-east-1.k8s.local:publishers): curl -s http://localhost:8001/.well-known/oauth-authorization-server | jq
{
  "issuer": "https://mydomain.okta.com",
  "authorization_endpoint": "https://mydomain.okta.com/oauth2/v1/authorize",
  "token_endpoint": "https://mydomain.okta.com/oauth2/v1/token",
  "registration_endpoint": "http://localhost:8001/oauth/register",
  "response_types_supported": [
    "code",
    "token",
    "id_token",
    "code id_token",
    "code token",
    "id_token token",
    "code id_token token"
  ],
  "response_modes_supported": [
    "query",
    "fragment",
    "form_post",
    "okta_post_message"
  ],
  "grant_types_supported": [
    "authorization_code",
    "implicit",
    "refresh_token",
    "password",
    "client_credentials",
    "urn:ietf:params:oauth:grant-type:device_code",
    "urn:openid:params:grant-type:ciba",
    "urn:okta:params:oauth:grant-type:otp",
    "http://auth0.com/oauth/grant-type/mfa-otp",
    "urn:okta:params:oauth:grant-type:oob",
    "http://auth0.com/oauth/grant-type/mfa-oob"
  ],
  "subject_types_supported": [
    "public"
  ],
  "scopes_supported": [
    "okta.users.manage",
    "okta.users.manage.self",
    "okta.users.read",
    "okta.users.read.self",
    "okta.linkedObjects.manage",
    "okta.linkedObjects.read",
    "okta.profileMappings.manage",
    "okta.profileMappings.read",
    "okta.userTypes.manage",
    "okta.userTypes.read",
    "okta.clients.manage",
    "okta.clients.register",
    "okta.clients.read",
    "okta.appGrants.manage",
    "okta.appGrants.read",
    "okta.policies.manage",
    "okta.policies.read",
    "okta.groups.manage",
    "okta.groups.read",
    "okta.inlineHooks.manage",
    "okta.inlineHooks.read",
    "okta.eventHooks.manage",
    "okta.eventHooks.read",
    "okta.events.read",
    "okta.logs.read",
    "okta.apps.manage",
    "okta.apps.read",
    "okta.schemas.manage",
    "okta.schemas.read",
    "okta.idps.manage",
    "okta.idps.read",
    "okta.factors.manage",
    "okta.factors.read",
    "okta.riskProviders.manage",
    "okta.riskProviders.read",
    "okta.roles.manage",
    "okta.roles.read",
    "okta.orgs.manage",
    "okta.orgs.read",
    "okta.domains.manage",
    "okta.domains.read",
    "okta.brands.manage",
    "okta.brands.read",
    "okta.sessions.manage",
    "okta.sessions.read",
    "okta.templates.manage",
    "okta.templates.read",
    "okta.trustedOrigins.manage",
    "okta.trustedOrigins.read",
    "okta.threatInsights.manage",
    "okta.threatInsights.read",
    "okta.behaviors.manage",
    "okta.behaviors.read",
    "okta.networkZones.manage",
    "okta.networkZones.read",
    "okta.agentPools.manage",
    "okta.agentPools.read",
    "okta.reports.read",
    "okta.features.manage",
    "okta.features.read",
    "okta.certificateAuthorities.manage",
    "okta.certificateAuthorities.read",
    "okta.principalRateLimits.manage",
    "okta.principalRateLimits.read",
    "okta.rateLimits.manage",
    "okta.rateLimits.read",
    "okta.apiTokens.manage",
    "okta.apiTokens.read",
    "okta.personal.adminSettings.manage",
    "okta.personal.adminSettings.read",
    "openid",
    "email",
    "profile",
    "address",
    "phone",
    "offline_access",
    "groups"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "client_secret_jwt",
    "private_key_jwt",
    "none"
  ],
  "claims_supported": [
    "ver",
    "jti",
    "iss",
    "aud",
    "iat",
    "exp",
    "cid",
    "uid",
    "scp",
    "sub"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "introspection_endpoint": "https://mydomain.okta.com/oauth2/v1/introspect",
  "introspection_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "client_secret_jwt",
    "private_key_jwt",
    "none"
  ],
  "revocation_endpoint": "https://mydomain.okta.com/oauth2/v1/revoke",
  "revocation_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "client_secret_jwt",
    "private_key_jwt",
    "none"
  ],
  "end_session_endpoint": "https://mydomain.okta.com/oauth2/v1/logout",
  "request_parameter_supported": true,
  "request_object_signing_alg_values_supported": [
    "HS256",
    "HS384",
    "HS512",
    "RS256",
    "RS384",
    "RS512",
    "ES256",
    "ES384",
    "ES512"
  ],
  "device_authorization_endpoint": "https://mydomain.okta.com/oauth2/v1/device/authorize",
  "pushed_authorization_request_endpoint": "https://mydomain.okta.com/oauth2/v1/par",
  "backchannel_token_delivery_modes_supported": [
    "poll"
  ],
  "backchannel_authentication_request_signing_alg_values_supported": [
    "HS256",
    "HS384",
    "HS512",
    "RS256",
    "RS384",
    "RS512",
    "ES256",
    "ES384",
    "ES512"
  ],
  "dpop_signing_alg_values_supported": [
    "RS256",
    "RS384",
    "RS512",
    "ES256",
    "ES384",
    "ES512"
  ]
}

Click on the needs login button

Result: Cursor generates authorization url for the user as such:

https://mydomain.okta.com/oauth2/v1/authorize?response_type=code
	&client_id=0oa1ma6l88j9T2Tjh358
	&code_challenge=wUXTVKMG2GnPPfvYGpFXX09MLccQlxNmiPX02K_uhaE
	&code_challenge_method=S256
	&redirect_uri=cursor://anysphere.cursor-retrieval/oauth/user-my-mcp/callback
	&resource=http://localhost:8001/

Consequence: My Oauth Provider (Okta) does not authenticate the request because it’s missing the required scope and state parameters.

Expected Behavior

Cursor should generate a valid authorization url so the user can authenticate.

Operating System

MacOS

Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.2.4
VSCode Version: 1.99.3
Commit: a8e95743c5268be73767c46944a71f4465d05c90
Date: 2025-07-10T16:53:59.659Z
Electron: 34.5.1
Chromium: 132.0.6834.210
Node.js: 20.19.0
V8: 13.2.152.41-electron.0
OS: Darwin arm64 24.5.0

Additional Information

If I manually populate scope and state, the Oauth flow completes correctly and the MCP server proceeds to work.

Does this stop you from using Cursor

Yes - Cursor is unusable

SudhakarGitMS · August 5, 2025, 6:49pm

Hi, we are also hitting same issue with cursor client.. whereas other clients are working fine. Is there any update on this from cursor team?

system · August 27, 2025, 6:50pm

This topic was automatically closed 22 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
MCP OAuth2 authentication code and implicit problems Bug Reports	3	344	July 26, 2025
We need Cursor to support OAuth flow for remote MCP servers Feature Requests	7	2217	July 28, 2025
Cursor doesn't handle MCP server's authorization_servers correctly Bug Reports	1	51	August 18, 2025
OAuth MCP login via custom protocol fails on Linux AppImage Bug Reports	1	97	August 18, 2025
MCP Oauth not working on Ubuntu Bug Reports	2	166	July 27, 2025