Class: Hitch::PublicEndpointController

Inherits:
ActionController::Base
  • Object
show all
Includes:
HostValidation, IssuerUrl, OauthParameterValidation
Defined in:
app/controllers/hitch/public_endpoint_controller.rb

Overview

Base for the gem's PUBLIC OAuth endpoints (token, register, revoke, metadata, /.well-known/*). These serve MCP clients (Claude.ai, Claude Code, ChatGPT, Cursor, etc.) that are NOT browsers and have NO host Rails session — the OAuth dance brings them to a session, it doesn't start with one.

Inherits from ActionController::Base directly (not the host's ApplicationController) so the host's auth concern, browser-version guard, layout, helpers, and other before-actions don't apply. Session cookies / Rack-level middleware still flow because those live outside the controller layer.

The consent screen (AuthorizationsController) is deliberately NOT in this category — it must integrate with the host's auth concern to identify the user granting consent.