{{ message }}
fix(client): OAuth well-known fallback on 4xx and authorization-server origin - #2785
Open
tiagovilasboas wants to merge 4 commits into
Open
tiagovilasboas wants to merge 4 commits into
tiagovilasboas wants to merge 4 commits into
Conversation
Path-inserted well-known discovery already retries on 4xx, but the root fallback URL was built from the resource/issuer URL. When the authorization server lives on a different host, that fetched the wrong metadata document. Build the fallback from metadataServerUrl (the AS) and pass the resource URL only as the path prefix in discoverOAuthMetadata. Fixes modelcontextprotocol#2783 Fixes modelcontextprotocol#2784 Co-authored-by: Tiago Vilas Boas <tcarvalhovb@gmail.com>
Add mocked-fetch cases for 401/403/404 path-aware fallback, 200 short-circuit when resource and authorization-server hosts differ, and continuation on 4xx during authorization-server metadata discovery. Co-authored-by: Tiago Vilas Boas <tcarvalhovb@gmail.com>
Co-authored-by: Tiago Vilas Boas <tcarvalhovb@gmail.com>
Co-authored-by: Tiago Vilas Boas <tcarvalhovb@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes OAuth well-known metadata discovery for remote MCP servers behind CDNs / split resource vs authorization-server hosts.
#2783 — fallback on 4xx, not only 404
Path-inserted well-known URLs (
/.well-known/oauth-protected-resource/<path>,/.well-known/oauth-authorization-server/<path>) are often answered with 401 or 403 by CDNs / bot protection instead of 404. Discovery already treated any 4xx (plus 502) as a miss and retried the root well-known document; this change keeps that predicate and adds coverage so 401/403/404 fall back, 200 short-circuits, and non-502 5xx does not fall back.Repro: Retool
https://hashnote.retool.com/mcp— path-aware PRM returns 401, root PRM returns 200.#2784 — fallback URL must use the authorization-server host
When the resource URL and the authorization server are on different hosts, the root fallback was built from the resource URL (
new URL('/.well-known/…', issuer)). That fetched an unrelated metadata document.The fallback is now built from
metadataServerUrl(the authorization server / issuer host).discoverOAuthMetadata(resourceUrl, { authorizationServerUrl })again uses the resource path only as the well-known suffix and keeps the retry on the AS origin.Repro: Superhuman — path-aware AS
https://id.superhuman.com/.well-known/oauth-authorization-server/apis/mcp→ 403; roothttps://id.superhuman.com/.well-known/oauth-authorization-server→ 200. The client must not fall back tohttps://docs.superhuman.com/.well-known/oauth-authorization-server.Test plan
fetchinpackages/client/test/client/auth.test.tspnpm --filter @modelcontextprotocol/client test— 884 passed (full client suite)vitest run test/client/auth.test.ts— 268 passedFixes #2783
Fixes #2784