Requests to oauth the token endpoint with refresh_token grant type set invalid content-type header

[kylekizirian]

Inspector Version

0.21.1

Describe the bug
MCP inspector makes requests to the oauth token endpoint with an invalid content-type application/json, application/x-www-form-urlencoded for the refresh_token grant type.

When the MCP inspector initially authenticates, it makes the first request to the token endpoint with the "authorization_code" grant type, and it correctly sets content-type: application/x-www-form-urlencoded. When the initial access token expires, and it requests a new one from the token endpoint with the refresh_token endpoint, it incorrectly sets content-type: application/json, application/x-www-form-urlencoded.

Here are screenshots from chrome devtools, the first is the initial token request with the "authorization_code" grant type, which sets the correct content-type. And the second is the "refresh_token" request, which sets the invalid content-type.

Initial token request with "authorization_code" grant type:

And the subsequent request with "refresh_token" grant type:

To Reproduce

1. Connect to an MCP server and go through the authorization flow. Observe network tools, and note that the initial request to the oauth token endpoint sets content-type: application/x-www-form-urlencoded
2. Wait for the initial access token to expire, and note that the subsequent request to the token endpoint sets content-type: application/json, application/x-www-form-urlencoded

Expected behavior
Requests to the token endpoint always set content-type: application/x-www-form-urlencoded. The OAuth spec is clear that requests to the token endpoint must use this:
https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-15.html#name-token-endpoint-request

Screenshots

Initial token request with "authorization_code" grant type:

Subsequent token request with "refresh_token" grant type:

Environment (please complete the following information):

• MacOS Tahoe
• Chrome

Additional context
N/A

Version Consideration

Inspector V2 is under development to address architectural and UX improvements. During this time, V1 contributions should focus on bug fixes and MCP spec compliance. See CONTRIBUTING.md for more details.

[kylekizirian]

This seems similar to #1143, but I wasn't totally sure if this is the same underlying issue or not. Feel free to close if this is the same underlying issue, and is fixed by #1157

[lanxevo3]

This is a simple fix — the token refresh code is likely using JSON content-type instead of form-urlencoded when it should switch based on grant type. I can patch this today. lanxevo3: https://gist.github.com/lanxevo3/268a019f1f7d5b1fa2b465704a0301cd

[kylekizirian]

This is a simple fix — the token refresh code is likely using JSON content-type instead of form-urlencoded when it should switch based on grant type. I can patch this today. lanxevo3: https://gist.github.com/lanxevo3/268a019f1f7d5b1fa2b465704a0301cd

@lanxevo3 thank you for taking a look. The content-type should always be form-urlencoded, no matter the grant type. Here is the relevant section of the OAuth2.1 spec:
https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-15.html#name-token-endpoint-request

[lanxevo3]

PR up: modelcontextprotocol/typescript-sdk#1774 — adds defensive Content-Type enforcement in executeTokenRequest() and registerClient() to ensure form-urlencoded is always used per OAuth 2.1 §3.2.