modelcontextprotocol/example-remote-server
Watch
1
0
Fork
You've already forked example-remote-server
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Revert OAuth metadata change for backwards compatibility

Browse source 
Keep serving .well-known/oauth-authorization-server from MCP server
in separate mode as some clients may expect to find it there
This commit is contained in:
Basil Hosmer 2025-09-23 16:19:47 -04:00
commit dbd3e9a853
No known key found for this signature in database
1 changed files with 10 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

24
src/index.ts
View file

@ -1,5 +1,5 @@
import { BearerAuthMiddlewareOptions, requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js"; import { BearerAuthMiddlewareOptions, requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
import { AuthRouterOptions, getOAuthProtectedResourceMetadataUrl, mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js"; import { AuthRouterOptions, getOAuthProtectedResourceMetadataUrl, mcpAuthRouter, mcpAuthMetadataRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
import cors from "cors"; import cors from "cors";
import rateLimit from "express-rate-limit"; import rateLimit from "express-rate-limit";
import express from "express"; import express from "express";
@ -227,19 +227,15 @@ if (AUTH_MODE === 'integrated') {
} }
} }
// In separate mode, we serve minimal OAuth metadata that points to the auth server // BACKWARDS COMPATIBILITY: We serve OAuth metadata from the MCP server even in separate mode
// This allows OAuth clients to discover the authorization endpoints // This is technically redundant since the auth server handles all OAuth operations,
// but some clients may expect to find .well-known/oauth-authorization-server on the
// Serve OAuth protected resource metadata endpoint // resource server itself. The metadata points to the external auth server endpoints.
app.get('/.well-known/oauth-protected-resource', (req, res) => { app.use(mcpAuthMetadataRouter({
res.json({ oauthMetadata: authMetadata,
resource: BASE_URI, resourceServerUrl: new URL(BASE_URI),
authorization_server: AUTH_SERVER_URL, resourceName: "MCP Everything Server"
bearer_methods_supported: ['header'], }));
resource_documentation: `${BASE_URI}/docs`,
resource_signing_alg_values_supported: ['HS256']
});
});
// Configure bearer auth with external verifier // Configure bearer auth with external verifier
const externalVerifier = new ExternalAuthVerifier(AUTH_SERVER_URL); const externalVerifier = new ExternalAuthVerifier(AUTH_SERVER_URL);