cf-mcp-server-clerk

The project demonstrates good security practices for OAuth, including RFC 9700 compliant CSRF and state validation with one-time use tokens stored in KV. Secure cookies (`__Host-` prefix, HttpOnly, Secure, SameSite=Lax) and signed client approval cookies are used. Input URLs and text for display in the approval dialog are sanitized (`sanitizeText`, `sanitizeUrl`) to prevent XSS. The `JSON.parse(atob(encodedState))` is used, but it's protected by prior CSRF validation and later state validation against KV and a session-bound hash, mitigating injection risks. The `README` explicitly warns it's a demo and requires further production-level security measures.