fix: Include pathname in resourceServer for RFC 8707 path-aware audience validation

[bokhi]

Fixes #108

Problem

When using RFC 8707 Resource Indicators with path components (e.g., resource=https://example.com/api), token validation fails with:

invalid_token: Token audience does not match resource server

This breaks OAuth flows for services like ChatGPT custom connectors.

Root Cause

In handleApiRequest, the resourceServer is computed using only the origin:

const resourceServer = `${requestUrl.protocol}//${requestUrl.host}`;

However, RFC 8707 recommends using full URLs with paths for resource indicators. Since audienceMatches performs strict equality (===):

• Token audience: https://example.com/api (from authorization request's resource parameter)
• Resource server: https://example.com (computed from request URL)
• Result: mismatch → validation fails

Solution

This PR updates the resourceServer computation in both internal and external token validation flows to include the pathname component:

const resourceServer = `${requestUrl.protocol}//${requestUrl.host}${requestUrl.pathname}`;

Changes

• src/oauth-provider.ts line 2194: Include pathname in resourceServer (internal token validation)
• src/oauth-provider.ts line 2228: Include pathname in resourceServer (external token validation)

Testing

Tested with ChatGPT custom connector:

• ✅ Authorization flow with resource=https://server/mcp
• ✅ Token issued with aud: "https://server/mcp"
• ✅ API request to https://server/mcp succeeds
• ✅ Audience validation passes

References

• RFC 8707: Resource Indicators for OAuth 2.0
• Section 2: "The value of the 'resource' parameter MUST be an absolute URI"
• Section 3.1: "The authorization server MUST set the 'aud' claim to the resource value"

[changeset-bot]

🦋 Changeset detected

Latest commit: 7609828

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/workers-oauth-provider	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/workers-oauth-provider/@cloudflare/workers-oauth-provider@109

commit: 7609828

[mattzcarey]

Looking at this :) thanks for your contribution.