OAuth loopback callback rejected for federated IdPs (Referer host ≠ IdP host) — regression in 1.21459.0

### MCP server URL or name

`https://mcp.example.com/mcp` (a managed connector; its OAuth authorization server is **Google-federated** — user signs in at `accounts.google.com`. Hostname redacted.)

### How are you connecting to this server?

Managed/enterprise deployment via `managedMcpServers` with `oauth: { clientId, callbackHost: 127.0.0.1, callbackPort: 3120 }`, connected through the direct MCP host (`custom3p-mcp` / `directMcpHost`). `inferenceProvider: gateway`.

### Where does the issue occur?

Claude Desktop **1.21459.0** on macOS 15.6 (Darwin 24.6.0). Interactive OAuth (Connect button).

### When did you last reproduce this?

2026-07-15

### Browser and OS

Claude Desktop 1.21459.0 (Electron), macOS 15.6 / Darwin 24.6.0

### Describe the issue

After updating to **1.21459.0**, interactive OAuth re-authorization fails for any managed MCP connector whose sign-in is **federated to a different host** (e.g. an IdP that redirects through Google/Okta/Azure AD). The browser opens, the user completes sign-in, but the app **rejects the loopback callback** because the callback's `Referer` host is the upstream federation IdP (`accounts.google.com`) rather than the connector's own IdP host (`mcp.example.com`). The flow can never complete, so the connector cannot be (re)connected.

This connector authorized and refreshed successfully for months prior to this build; the failure is new after updating. Existing cached tokens masked it until the connector was disconnected, forcing a fresh interactive auth.

**Control (same build, self-contained IdPs succeed):** on the identical build/session, connectors whose login is on their own domain authorize fine — Intercom (`mcp.intercom.com`) and Slack (`slack.com`) both open the browser, save tokens, and connect. The only difference is federation: their final redirect is on their own host so `Referer` matches the IdP; the federated connector's final redirect comes from `accounts.google.com`.

### Error details

`~/Library/Logs/Claude/main.log`, repeated on every retry:

```
[custom3p-mcp] opening authorize URL { server: 'Knowledge Base', host: 'mcp.example.com', state: '…' }
[custom3p-mcp] waiting for OAuth callback (browser opened) { server: 'Knowledge Base' }
[custom3p-mcp] rejecting loopback callback: Referer host "accounts.google.com" != IdP "mcp.example.com" (Origin absent)
```

Successful control on the same build:

```
[custom3p-mcp] opening authorize URL { server: 'Intercom', host: 'mcp.intercom.com', … }
[custom3p-mcp] saved OAuth tokens { server: 'Intercom', hasRefresh: true }
[custom3p-mcp] server connected { name: 'Intercom', toolCount: 13 }
```

### Expected behavior

The loopback callback is accepted and tokens are saved (as before 1.21459.0). Callback authenticity should be bound to the CSRF `state` parameter, not to the `Referer`/`Origin` host — which is unreliable across federated redirects and is intentionally stripped by some IdPs' `Referrer-Policy`.

### Additional context

**Root cause hypothesis:** 1.21459.0 appears to have added a loopback-callback check requiring `Referer` host == connector IdP host. This assumption breaks for any federated login, where the last page before the `127.0.0.1` redirect is the upstream identity provider. `Origin` is absent on the redirect, so the check falls back to `Referer` and hard-rejects.

**Impact:** any managed OAuth connector using federated sign-in (corporate SSO via Google/Okta/Azure AD) becomes impossible to (re)authorize after the update.

**Suggested fix:** validate the callback on `state`; when `Referer`/`Origin` are absent or cross-origin, allow the callback if `state` matches rather than rejecting.

**Workarounds:** server-side only, if you control the IdP (make the final loopback redirect originate from the connector's own host, or set `Referrer-Policy: no-referrer` on the redirecting hop). Not possible for third-party IdPs. No client-side or managed-config workaround (no version-pin key; `disableAutoUpdates` only freezes the already-updated build).

Start with ~/Library/Logs/Claude/main.log and the managedMcpServers OAuth callback flow, reproducing interactive authorization for a federated connector on Claude Desktop 1.21459.0. Compare the callback handling with the successful Intercom or Slack control cases. Done means the federated loopback callback is accepted when its state is valid and OAuth tokens are saved so the connector connects.

Scritto dal modello di indicizzazione a partire dal testo della issue.