vasok71

Forum Replies Created

Viewing 2 replies - 1 through 2 (of 2 total)
  • Forum: Plugins
    In reply to: [Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini] ChatGPT authorize request is missing required PKCE parameters
    Thread Starter vasok71

    (@vasok71)

    5 days, 5 hours ago

    Hello, thank you for the detailed explanation.

    mushwell.com is hosted on SiteGround Managed WordPress, with Cloudflare in front of it.

    There is one relevant detail: SiteGround previously identified an anti-bot/WAF rule that was blocking ChatGPT’s POST request to /register based on the python-httpx/0.27.0 User-Agent, before the request reached PHP/WordPress.

    SiteGround disabled only that specific rule for mushwell.com. After that change:

    • POST /register started returning HTTP 201
    • DCR began working correctly
    • oauth:register appeared as SUCCESS in Royal MCP

    Cloudflare Bot Fight Mode is disabled, and a custom Skip rule is configured for the Royal MCP OAuth and MCP routes.

    The current failing /authorize request is a GET request opened in Chrome from my own IP address. It reaches Royal MCP, but the raw REQUEST_URI does not contain code_challenge or code_challenge_method.

    I have not tested the connection from Claude.ai yet. I will first ask SiteGround whether any request-inspection, request-normalization, ModSecurity or URL-rewriting layer could be dropping those two query parameters before the request reaches PHP.

    Please let me know if there is any specific SiteGround log, rule or diagnostic test you would recommend requesting from them.

    Thank you.

    Forum: Plugins
    In reply to: [Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini] ChatGPT authorize request is missing required PKCE parameters
    Thread Starter vasok71

    (@vasok71)

    5 days, 6 hours ago

    Hello, thank you for checking this.

    Here is the exact Royal MCP Activity Log entry from the latest failed ChatGPT connection attempt. I have redacted only the IP address, client ID, state value and callback identifier:

    Request Data:

    {
  "method": "GET",
  "uri": "/authorize?response_type=code&client_id=[REDACTED]&redirect_uri=https://chatgpt.com/connector/oauth/[REDACTED]&scope=mcp:full&resource=https://mushwell.com/wp-json/royal-mcp/v1&state=[REDACTED]&ui_locales=es-ES",
  "ip": "[REDACTED]",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
  "client_id": "[REDACTED]",
  "grant_type": "",
  "response_type": "code"
}

    Response Data:

    {
  "http_status": 302,
  "code": "invalid_request",
  "description": "PKCE with code_challenge_method=S256 is required."
}

    As shown in the URI captured by Royal MCP, neither code_challenge nor code_challenge_method is present.

    The same result occurred in two consecutive ChatGPT connection attempts. Immediately before this, the real ChatGPT DCR request reached oauth:register successfully and Royal MCP returned HTTP 201 with a valid client ID.

    Does the uri field in Royal MCP Activity Logs represent the complete query string received by PHP? If so, it appears that the PKCE parameters were already absent when the request reached Royal MCP.

    Please let me know if you need any additional diagnostic information.

    Thank you.

Viewing 2 replies - 1 through 2 (of 2 total)