modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Compare auth server metadata issuer ignoring trailing slash (#955)

Browse source 
oauthex/auth_meta.go: fixes metadata issuer comparison to ignore
trailing slash difference

Google's gmail MCP server returns `https://accounts.google.com/` as the
Authorization Server in the Protected Resource Metadata, but returns
`https://accounts.google.com` in the Auth Server Metadata. This causes a
comparison failure per rfc8414 section-3.3: Authorization Server
Metadata Validation. The authorization server URL is meant to be a base
to build other URLs from, it does not seem necessary to enforce that the
trailing slash (or lack thereof) matches with the issuer URL. Please see
#953 for more details.

Fixes #953

---------

Co-authored-by: Guglielmo Colombo <guglielmoc@google.com>
This commit is contained in:
Jon 2026-05-14 00:26:57 -07:00 • committed by GitHub
commit da3535b678
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 15 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
oauthex/auth_meta.go
View file

@ -12,6 +12,7 @@ import (
"errors" "errors"
"fmt" "fmt"
"net/http" "net/http"
"strings"
) )
// AuthServerMeta represents the metadata for an OAuth 2.0 authorization server, // AuthServerMeta represents the metadata for an OAuth 2.0 authorization server,
@ -145,7 +146,7 @@ func GetAuthServerMeta(ctx context.Context, metadataURL, issuer string, c *http.
} }
return nil, fmt.Errorf("%v", err) // Do not expose error types. return nil, fmt.Errorf("%v", err) // Do not expose error types.
} }
if asm.Issuer != issuer { if strings.TrimRight(asm.Issuer, "/") != strings.TrimRight(issuer, "/") {
// Validate the Issuer field (see RFC 8414, section 3.3). // Validate the Issuer field (see RFC 8414, section 3.3).
return nil, fmt.Errorf("metadata issuer %q does not match issuer URL %q", asm.Issuer, issuer) return nil, fmt.Errorf("metadata issuer %q does not match issuer URL %q", asm.Issuer, issuer)
} }

16
oauthex/auth_meta_test.go
View file

@ -35,9 +35,10 @@ func TestAuthMetaParse(t *testing.T) {
func TestGetAuthServerMetaPKCESupport(t *testing.T) { func TestGetAuthServerMetaPKCESupport(t *testing.T) {
ctx := context.Background() ctx := context.Background()
tests := []struct { tests := []struct {
name string name string
hasPKCESupport bool hasPKCESupport bool
wantError string wantError string
issuerWithTrailingSlash bool
}{ }{
{ {
name: "server_with_pkce_support", name: "server_with_pkce_support",
@ -48,6 +49,12 @@ func TestGetAuthServerMetaPKCESupport(t *testing.T) {
hasPKCESupport: false, hasPKCESupport: false,
wantError: "does not implement PKCE", wantError: "does not implement PKCE",
}, },
{
// ProtectedResourceMetadata may contain AuthorizationServers with a trailing slash (see Issue #953)
name: "issuer_with_trailing_slash",
hasPKCESupport: true,
issuerWithTrailingSlash: true,
},
} }
for _, tt := range tests { for _, tt := range tests {
@ -85,6 +92,9 @@ func TestGetAuthServerMetaPKCESupport(t *testing.T) {
u, _ := url.Parse(ts.URL) u, _ := url.Parse(ts.URL)
issuer := "https://localhost:" + u.Port() issuer := "https://localhost:" + u.Port()
metadataURL := issuer + "/.well-known/oauth-authorization-server" metadataURL := issuer + "/.well-known/oauth-authorization-server"
if tt.issuerWithTrailingSlash {
issuer += "/"
}
// The fake server presents a cert for example.com; set ServerName accordingly. // The fake server presents a cert for example.com; set ServerName accordingly.
httpClient := ts.Client() httpClient := ts.Client()