From 2d582bb4fa1f05eb9f44b7b963b6b01f1fdeefc6 Mon Sep 17 00:00:00 2001
From: jubnl <jgunther021@gmail.com>
Date: Sun, 10 May 2026 20:08:11 +0200
Subject: [PATCH] fix(mcp): replace relative oauth constent redirect by
 absolute redirect derived from APP_URL (#987)

---
 server/src/mcp/oauthProvider.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/src/mcp/oauthProvider.ts b/server/src/mcp/oauthProvider.ts
index 943a515f..592fd282 100644
--- a/server/src/mcp/oauthProvider.ts
+++ b/server/src/mcp/oauthProvider.ts
@@ -147,7 +147,8 @@ export const trekOAuthProvider: OAuthServerProvider = {
         if (params.state) qs.set('state', params.state);
         if (params.resource) qs.set('resource', params.resource.href);
 
-        res.redirect(302, `/oauth/consent?${qs.toString()}`);
+        const base = getMcpSafeUrl().replace(/\/+$/, '');
+        res.redirect(302, `${base}/oauth/consent?${qs.toString()}`);
     },
 
     // Not called because skipLocalPkceValidation = true.