[fix] 帳密登入在 MCP OAuth 流程下卡在 Signing in：改用整頁導頁避開 callbackURL 的跨網域 fetch CORS - #60
Merged
Conversation
✅ SonarQube Quality Gate passed — pathorsAI_internal0 open issues on this PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
問題
帳密登入在走 MCP OAuth 流程（ChatGPT / Claude / Codex 從
/api/auth/mcp/authorize進來授權）時，按下登入後永遠卡在「Signing in…」，OAuth 無法完成。Google / SSO 沒這問題。根因
better-auth 的 email 登入（
signIn.email）走的是fetch。當帶上callbackURL時，伺服器回 302，fetch會自動跟著 redirect 一路走。當callbackURL是 MCP 的/api/auth/mcp/authorize時，它下一跳會 302 到claude.ai/api/mcp/auth_callback——這是跨網域。fetch撞上 CORS，直接Failed to fetch，於是按鈕永遠停在 submitting 狀態、OAuth 斷掉。Google / SSO 之所以沒事，是因為它們本來就走整頁跳轉（top-level navigation），不受 CORS 限制。
修法
不再把
callbackURL傳給signIn.email。改成：email 登入只負責「建立 session」，成功後由我們自己做整頁導頁window.location.href = redirectTo。top-level navigation 跟著 302 跳去claude.ai不受 CORS 限制，OAuth 流程正常完成。失敗時維持原本行為（401 一律講「email 或密碼不正確」避免帳號探測），並提前
return。