fix(auth): reject null redirect_uris in DCR registration

An explicit JSON null for redirect_uris passes OAuthClientMetadata validation (the list[AnyUrl] | None union bypasses min_length), then crashes the validation loop with TypeError, returning 500 instead of an RFC 7591 error response. Reject null as invalid_client_metadata before iterating and cover it with a registration test.

Author: Varshith-Kali

src/mcp/server/auth/handlers/register.py

@@ -1,10 +1,10 @@
 import secrets
 import time
 from dataclasses import dataclass
-from typing import Any, cast
+from typing import Any
 from uuid import uuid4
 
-from pydantic import AnyUrl, BaseModel, ValidationError
+from pydantic import BaseModel, ValidationError
 from starlette.requests import Request
 from starlette.responses import Response
 
@@ -36,10 +36,20 @@ async def handle(self, request: Request) -> Response:
             body = await request.body()
             client_metadata = OAuthClientMetadata.model_validate_json(body)
 
-            # Validate redirect_uris per RFC 7591 section 2. The metadata
-            # model requires a non-empty list (min_length=1), so no presence
-            # guard is needed; cast narrows the optional field for pyright.
-            for uri in cast(list[AnyUrl], client_metadata.redirect_uris):
+            # Validate redirect_uris per RFC 7591 section 2. The type union
+            # with None means an explicit JSON null passes model validation
+            # (min_length only constrains the list branch), so reject it as
+            # invalid metadata before iterating.
+            redirect_uris = client_metadata.redirect_uris
+            if redirect_uris is None:
+                return PydanticJSONResponse(
+                    content=RegistrationErrorResponse(
+                        error="invalid_client_metadata",
+                        error_description="redirect_uris must be a non-empty list",
+                    ),
+                    status_code=400,
+                )
+            for uri in redirect_uris:
                 try:
                     validate_redirect_uri(uri)
                 except ValueError as e:

tests/server/auth/test_error_handling.py

@@ -324,3 +324,21 @@ async def test_registration_rejects_non_http_redirect_uri_scheme(client: httpx2.
     data = response.json()
     assert data["error"] == "invalid_redirect_uri"
     assert data["error_description"] == "Redirect URI must use an HTTP(S) scheme"
+
+
+@pytest.mark.anyio
+async def test_registration_rejects_null_redirect_uris(client: httpx2.AsyncClient):
+    client_data = {
+        "redirect_uris": None,
+        "token_endpoint_auth_method": "client_secret_post",
+        "grant_types": ["authorization_code", "refresh_token"],
+        "response_types": ["code"],
+        "client_name": "Test Client",
+    }
+
+    response = await client.post("/register", json=client_data)
+
+    assert response.status_code == 400, response.content
+    data = response.json()
+    assert data["error"] == "invalid_client_metadata"
+    assert data["error_description"] == "redirect_uris must be a non-empty list"