[ryuzdev]

Owner: Gemini's custom MCP OAuth got stuck on the consent page after Allow. Server side the flow had succeeded (the pending request had an account and a code), so the browser dropped the redirect.

Cause: the Allow/Deny form answered with a 302 to the client. Browsers apply CSP form-action to every hop of a form submission's redirect chain; the consent page allows 'self' plus the request's redirect origin (#16, for Perplexity), but Gemini's redirect URI (https://oauth-redirect.googleusercontent.com/r/...) bounces on to other Google origins, which form-action blocks.

Fix: Allow/Deny now answers 200 with a small "Returning to …" page that navigates by <meta http-equiv="refresh" content="0;url=…"> (a fresh navigation that form-action doesn't govern) plus a visible link as fallback. The URL is unchanged: code or error=access_denied, state, iss. Tests read the target from the page instead of Location. 438 pass.

Live as outer:0a92898; the owner re-tests Gemini.

Summary by CodeRabbit

• Bug Fixes
  • OAuth approval and denial now return a page that takes the browser back to the client, instead of redirecting directly.
  • The return URL preserves authorization parameters, including state and iss when present.
  • The page displays the destination host and provides a link to continue if automatic navigation doesn’t work.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: aa8041cd-c62a-4e7d-9432-935b008c1d88

Commits

Reviewing files that changed from the base of the PR and between 453c18e and 0a92898.

Files selected for processing: 3

• crates/outer/src/auth/oauth.rs
• crates/outer/src/auth/pages.rs
• crates/outer/src/auth/tests.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

OAuth Allow and Deny responses now return an HTTP 200 HTML page that directs the browser to the client return URL. The URL retains authorization parameters, including iss and state when supplied. Tests read response parameters from the page’s meta-refresh target.

Changes: OAuth browser return

Layer / File(s)	Summary
Build and verify the browser return crates/outer/src/auth/oauth.rs, crates/outer/src/auth/pages.rs, crates/outer/src/auth/tests.rs	The authorization handler renders a return page instead of sending a 302 response. The page includes a zero-delay meta refresh, the destination host, and a fallback link. Allow and Deny tests extract query parameters from the response body.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant OAuthHandler
  participant ReturnPage
  participant Browser
  participant Client
  OAuthHandler->>ReturnPage: Render authorization URL and display host
  ReturnPage-->>Browser: Return HTTP 200 HTML with meta refresh
  Browser->>Client: Navigate to authorization URL

Loading

Possibly related PRs

• ryuzcorp/outer#16: Adds the consent-page CSP rule for the client redirect origin, which relates to the OAuth browser return flow.

Merge Risk: Minimal · up to 0a928

The OAuth browser handoff preserves the redirect target without an established merge-blocking risk.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: OAuth Allow/Deny responses now use a return page instead of a 302 redirect. It also identifies the Gemini compatibility fix.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}