modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(auth): pass the challenge's resource_metadata URL to SDK auth()

Browse source 
An RFC 9728 `WWW-Authenticate: Bearer resource_metadata="…"` challenge was
parsed and then dropped by the normalized `AuthChallenge`, so every
challenge-driven `mcpAuth()` call ran discovery without it and probed
locations derived from the MCP server URL instead. OAuth failed outright
against any server whose metadata document lives off the well-known path.

The SDK handles this correctly inside its own transports, but the Inspector
never reaches that path — it intercepts the 401 and drives `auth()` itself
to capture the authorization URL and run the step-up scope union.

Carry the advertised URL on `AuthChallenge` as a string (it crosses the web
client's remote-backend boundary as JSON), convert it at the OAuth boundary,
and pass it to the standard challenge leg, the forced step-up leg, and CIMD
pre-registration — which runs before `auth()` and did its own discovery. A
malformed value is ignored rather than surfaced, matching the SDK's parser.
The callback leg needs nothing: SDK `auth()` persists the URL in its
discovery state.

Adds an `oauth.resourceMetadataPath` test-server mode that moves the
document off the well-known path entirely, so the integration test proves
discovery genuinely fails without the fix.

Closes #2071

Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-24 19:48:40 -04:00
commit f8a46726b7
1 changed files with 469 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
core/auth/cimd.ts
View file

@ -14,11 +14,18 @@ import type { BaseOAuthClientProvider } from "./providers.js";
* accepts an already-stored `client_id` (including `http://` URLs used by local
* dev/test metadata servers). Production CIMD metadata documents should still
* use HTTPS per SEP-991.
*
* `resourceMetadataUrl` is the RFC 9728 document advertised by the
* `WWW-Authenticate` challenge, when the caller has one. It matters here and
* not only in `auth()`: this runs *before* SDK `auth()`, so without it the
* pre-registration probe would do its own default-location discovery and miss
* a document served from a non-default path (#2071).
*/
export async function ensureCimdClientRegistration(params: {
serverUrl: string;
provider: BaseOAuthClientProvider;
fetchFn?: typeof fetch;
resourceMetadataUrl?: URL;
}): Promise<void> {
const clientMetadataUrl = params.provider.clientMetadataUrl?.trim();
if (!clientMetadataUrl) return;
@ -30,6 +37,7 @@ export async function ensureCimdClientRegistration(params: {
try {
resourceMetadata = await discoverOAuthProtectedResourceMetadata(
params.serverUrl,
{ resourceMetadataUrl: params.resourceMetadataUrl },
);
} catch {
resourceMetadata = undefined;