modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

auth: return scope in WWW-Authenticate header. (#834)

Browse source 
Also, emit the resource metadata URL in quotes to ensure proper parsing.


https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#protected-resource-metadata-discovery-requirements
This commit is contained in:
Maciej Kisiel 2026-03-17 16:34:10 +01:00 • committed by GitHub
commit 6af642cc79
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 108 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
auth/auth.go
View file

@ -8,6 +8,7 @@ import (
"context"
"encoding/json"
"errors"
"fmt"
"net/http"
"slices"
"strings"
@ -73,8 +74,17 @@ func RequireBearerToken(verifier TokenVerifier, opts *RequireBearerTokenOptions)
tokenInfo, errmsg, code := verify(r, verifier, opts)
if code != 0 {
if code == http.StatusUnauthorized || code == http.StatusForbidden {
if opts != nil && opts.ResourceMetadataURL != "" {
w.Header().Add("WWW-Authenticate", "Bearer resource_metadata="+opts.ResourceMetadataURL)
if opts != nil {
var params []string
if opts.ResourceMetadataURL != "" {
params = append(params, fmt.Sprintf("resource_metadata=%q", opts.ResourceMetadataURL))
}
if len(opts.Scopes) > 0 {
params = append(params, fmt.Sprintf("scope=%q", strings.Join(opts.Scopes, " ")))
}
if len(params) > 0 {
w.Header().Add("WWW-Authenticate", "Bearer "+strings.Join(params, ", "))
}
}
}
http.Error(w, errmsg, code)