modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(auth): pass the challenge's resource_metadata URL to SDK auth()

Browse source 
An RFC 9728 `WWW-Authenticate: Bearer resource_metadata="…"` challenge was
parsed and then dropped by the normalized `AuthChallenge`, so every
challenge-driven `mcpAuth()` call ran discovery without it and probed
locations derived from the MCP server URL instead. OAuth failed outright
against any server whose metadata document lives off the well-known path.

The SDK handles this correctly inside its own transports, but the Inspector
never reaches that path — it intercepts the 401 and drives `auth()` itself
to capture the authorization URL and run the step-up scope union.

Carry the advertised URL on `AuthChallenge` as a string (it crosses the web
client's remote-backend boundary as JSON), convert it at the OAuth boundary,
and pass it to the standard challenge leg, the forced step-up leg, and CIMD
pre-registration — which runs before `auth()` and did its own discovery. A
malformed value is ignored rather than surfaced, matching the SDK's parser.
The callback leg needs nothing: SDK `auth()` persists the URL in its
discovery state.

Adds an `oauth.resourceMetadataPath` test-server mode that moves the
document off the well-known path entirely, so the integration test proves
discovery genuinely fails without the fix.

Closes #2071

Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-24 19:48:40 -04:00
commit f8a46726b7
1 changed files with 469 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

28
test-servers/src/test-server-oauth.ts
View file

@ -27,6 +27,23 @@ export function getOAuthMode(
return config.mode ?? "combined";
}
/**
* The `WWW-Authenticate` challenge sent with every 401.
*
* RFC 9728 §5.1: a resource server advertises where its protected-resource
* metadata lives via the `resource_metadata` parameter. Only emitted when the
* config moves that document off the well-known path — otherwise the bare
* `Bearer` challenge keeps the existing fixtures byte-identical.
*/
function bearerChallenge(config: OAuthConfig, req: Request): string {
const path = config.resourceMetadataPath;
if (!path) {
return "Bearer";
}
const requestBaseUrl = `${req.protocol}://${req.get("host")}`;
return `Bearer resource_metadata="${new URL(path, requestBaseUrl).href}"`;
}
/**
* Set up OAuth routes on an Express application
* This adds all OAuth endpoints (authorization, token, metadata, etc.)
@ -76,7 +93,7 @@ export function createBearerTokenMiddleware(
// For streamable-http, the SDK checks response status and throws StreamableHTTPError with code 401
res.status(401);
res.setHeader("Content-Type", "application/json");
res.setHeader("WWW-Authenticate", "Bearer");
res.setHeader("WWW-Authenticate", bearerChallenge(config, req));
// Return a JSON-RPC error response format that the SDK will recognize
res.json({
jsonrpc: "2.0",
@ -113,7 +130,7 @@ export function createBearerTokenMiddleware(
// Return 401 - the SDK's transport should detect this and throw an error
res.status(401);
res.setHeader("Content-Type", "application/json");
res.setHeader("WWW-Authenticate", "Bearer");
res.setHeader("WWW-Authenticate", bearerChallenge(config, req));
// Return a JSON-RPC error response format that the SDK will recognize
res.json({
jsonrpc: "2.0",
@ -184,9 +201,12 @@ function setupMetadataEndpoints(
);
}
// OAuth Protected Resource Metadata
// OAuth Protected Resource Metadata. `resourceMetadataPath` moves the
// document off the well-known path entirely (rather than serving both), so
// a client that ignores the advertised `resource_metadata` URL gets a 404
// — see the field's doc comment.
app.get(
"/.well-known/oauth-protected-resource",
config.resourceMetadataPath ?? "/.well-known/oauth-protected-resource",
(req: Request, res: Response) => {
const requestBaseUrl = `${req.protocol}://${req.get("host")}`;
const resourceUrl = config.resource ?? new URL("/", requestBaseUrl).href;