Fix OAuth examples to use complete resource URLs - #3275
Conversation
There was a problem hiding this comment.
All reported issues were addressed across 12 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
|
Thanks for the contribution. This repository only keeps pull requests open when they're linked to an issue that a maintainer has assigned to the author — CONTRIBUTING.md explains why and how we work. This PR has been closed for now because you aren't currently assigned to #1264. If a maintainer would like this change as a PR from you, they'll assign you to #1264 and this PR will reopen automatically — there's nothing more you need to do. (If you opened the issue, this PR already shows up on its timeline.) There's no need to open a new PR — this one will be reopened. While it's closed, please push any updates as new commits rather than force-pushing, since GitHub can't reopen a PR whose branch has been rewritten. Maintainers: reopening this PR, removing the |
Closes #1264.
Problem
The OAuth examples did not consistently use the complete MCP endpoint as the resource identifier:
/mcp;/mcpeven when running SSE at/sse; and/mcpsubstring before constructing itsOAuthClientProvider.Strict RFC 9728 clients can reject those mismatches before authorization completes.
Changes
/mcpor/sse) as the simple-auth resource identifier and listening route.MCPServer.run()'s actual default address:http://127.0.0.1:8000/mcp.AuthSettings.resource_server_urlis the complete externally visible MCP endpoint, including mount or proxy prefixes.This PR does not infer or append public paths in SDK code. Internal routes cannot reveal ASGI mount paths or reverse-proxy prefixes. The earlier #2662 explored the same docs/example direction; this revision applies that conclusion to current
mainand adds focused regressions for the current examples.Validation
/mcp, SSE/sse, and exact client URL preservation on asyncio and Trio).SeCreateSymbolicLinkPrivilege(WinError 1314).uv.lockconsistency passed.AI assistance disclosure: I used Codex to inspect #1264 and the prior PR history, implement and test the changes, and reduce the original draft after review. I independently verified the final diff and the validation results above.