From 4c8b76b6f08d090bf6e7cf22f66d60ec3d0efdc6 Mon Sep 17 00:00:00 2001
From: "n8n-cat-bot[bot]" <283985454+n8n-cat-bot[bot]@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:24:56 +0000
Subject: [PATCH] fix: Use configured OAuth server rate limits (#40542)

Co-authored-by: n8n-cat-bot[bot] <n8n-cat-bot[bot]@users.noreply.github.com>
---
 .../__tests__/oauth.controller.api.test.ts    | 26 +++++++++++++++++++
 .../modules/oauth-server/oauth.controller.ts  | 13 +++++++---
 2 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/packages/cli/src/modules/oauth-server/__tests__/oauth.controller.api.test.ts b/packages/cli/src/modules/oauth-server/__tests__/oauth.controller.api.test.ts
index 97319a443cf..d5800b7cc0a 100644
--- a/packages/cli/src/modules/oauth-server/__tests__/oauth.controller.api.test.ts
+++ b/packages/cli/src/modules/oauth-server/__tests__/oauth.controller.api.test.ts
@@ -938,6 +938,32 @@ describe('IP rate limit configuration', () => {
 		}
 	});
 
+	test.each([
+		['GET', '/mcp-oauth/authorize'],
+		['POST', '/mcp-oauth/token'],
+		['POST', '/mcp-oauth/revoke'],
+		['POST', '/mcp-oauth/register'],
+		['GET', '/oauth/authorize'],
+		['POST', '/oauth/token'],
+		['POST', '/oauth/revoke'],
+		['POST', '/oauth/register'],
+	])('does not apply an SDK rate limit to %s %s', async (method, path) => {
+		const response =
+			method === 'GET'
+				? await testServer.restlessAgent.get(path)
+				: await testServer.restlessAgent.post(path).send({});
+
+		expect(response.statusCode).not.toBe(404);
+		expect(response.headers).not.toHaveProperty('ratelimit-policy');
+	});
+
+	test('does not cap authorization requests at the SDK default of 100', async () => {
+		for (let attempt = 0; attempt <= 100; attempt++) {
+			const response = await testServer.restlessAgent.get('/mcp-oauth/authorize');
+			expect(response.statusCode).toBe(400);
+		}
+	});
+
 	test.each([
 		'metadata',
 		'metadataOptions',
diff --git a/packages/cli/src/modules/oauth-server/oauth.controller.ts b/packages/cli/src/modules/oauth-server/oauth.controller.ts
index 05a6d2cfbc0..4350860eda8 100644
--- a/packages/cli/src/modules/oauth-server/oauth.controller.ts
+++ b/packages/cli/src/modules/oauth-server/oauth.controller.ts
@@ -81,10 +81,17 @@ const rfc9207IssuerParam: RequestHandler = (_req, res, next) => {
 // `/oauth/*` paths that future, non-MCP protected resources will advertise.
 const registerRouter = clientRegistrationHandler({
 	clientsStore: oauthServerService.clientsStore,
+	rateLimit: false,
+}) as Router;
+const authorizeRouter = authorizationHandler({
+	provider: oauthServerService,
+	rateLimit: false,
+}) as Router;
+const tokenRouter = tokenHandler({ provider: oauthServerService, rateLimit: false }) as Router;
+const revokeRouter = revocationHandler({
+	provider: oauthServerService,
+	rateLimit: false,
 }) as Router;
-const authorizeRouter = authorizationHandler({ provider: oauthServerService }) as Router;
-const tokenRouter = tokenHandler({ provider: oauthServerService }) as Router;
-const revokeRouter = revocationHandler({ provider: oauthServerService }) as Router;
 
 const sharedEndpointRouters = (basePath: '/mcp-oauth' | '/oauth'): StaticRouterMetadata[] => [
 	{