[2026-07-28] Authorization hardening (OAuth/OIDC)

Tracking issue for the MCP Spec 2026-07-28 release — Authorization hardening milestone.

Most of this milestone overlaps with the existing client-OAuth backlog (#315–#326). New SEP-specific work concentrates on issuer validation, AS-binding semantics, server-side scope emission, and OIDC offline_access handling.

SEPs covered

Sub-issues

• #360 — SEP-2468: Validate iss parameter in authorization response (client)
• #361 — SEP-2352: Key DCR/tokens by AS issuer; reject cross-AS reuse (client)
• #362 — SEP-2350: Emit per-operation scopes in insufficient_scope 403 responses (server)
• #363 — SEP-2207: Request offline_access against OIDC-flavored AS (client)
• #364 — SEP-2207: Audit PRM to ensure offline_access is not advertised as required (server)

Existing issues to annotate with SEP refs

• #315 (TokenStorage) → SEP-2352
• #318 (RFC 8414 AS metadata) → SEP-2351
• #319 (Auth Code + PKCE) → SEP-2468, SEP-2207
• #320 (DCR) → SEP-2352, SEP-837
• #321 (token_endpoint_auth_method) → SEP-837
• #322 (scope handling/step-up) → SEP-2350
• #323 (refresh_token grant) → SEP-2207

Notes

• All six SEPs are merged.
• PHP SDK client-side OAuth is largely unimplemented; the bulk of work is therefore on the client side via the existing #315–#326 backlog plus the new SEP-specific issues above. Server-side OAuth middleware needs targeted PRM/WWW-Authenticate audits only.

Beginne mit der Durchsicht der Unteraufgaben #360–#364 und des zugehörigen OAuth-Backlogs #315–#326. Lies anschließend die verknüpften SEP-Referenzen und die vorhandene Autorisierungsimplementierung. Dieses Tracking-Issue ist abgeschlossen, sobald seine fünf Unteraufgaben gelöst und die aufgeführten PRM- und WWW-Authenticate-Audits abgeschlossen sind.