modelcontextprotocol/python-sdk
Watch
1
0
Fork
You've already forked python-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add AuthSettings.validate_token_resource to check a bearer token's resource (#3447)

Browse source
This commit is contained in:
Max 2026-09-05 03:35:55 +01:00 • committed by GitHub
commit 0c9136841f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 293 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

9
examples/stories/oauth_client_credentials/server.py
View file

@ -66,7 +66,14 @@ def build_app() -> Starlette:
if creds != f"{DEMO_CLIENT_ID}:{DEMO_CLIENT_SECRET}":
return JSONResponse({"error": "invalid_client"}, status_code=401)
access = f"access_{secrets.token_hex(16)}"
issued[access] = AccessToken(token=access, client_id=DEMO_CLIENT_ID, scopes=[DEMO_SCOPE], expires_at=None)
resource = form.get("resource") # RFC 8707: bind the token to the resource the client asked for
issued[access] = AccessToken(
token=access,
client_id=DEMO_CLIENT_ID,
scopes=[DEMO_SCOPE],
expires_at=None,
resource=resource if isinstance(resource, str) else None,
)
body = OAuthToken(access_token=access, token_type="Bearer", expires_in=3600, scope=DEMO_SCOPE)
return JSONResponse(body.model_dump(exclude_none=True), headers={"cache-control": "no-store"})

9
examples/stories/oauth_client_credentials/server_lowlevel.py
View file

@ -63,7 +63,14 @@ def build_app() -> Starlette:
if creds != f"{DEMO_CLIENT_ID}:{DEMO_CLIENT_SECRET}":
return JSONResponse({"error": "invalid_client"}, status_code=401)
access = f"access_{secrets.token_hex(16)}"
issued[access] = AccessToken(token=access, client_id=DEMO_CLIENT_ID, scopes=[DEMO_SCOPE], expires_at=None)
resource = form.get("resource") # RFC 8707: bind the token to the resource the client asked for
issued[access] = AccessToken(
token=access,
client_id=DEMO_CLIENT_ID,
scopes=[DEMO_SCOPE],
expires_at=None,
resource=resource if isinstance(resource, str) else None,
)
body = OAuthToken(access_token=access, token_type="Bearer", expires_in=3600, scope=DEMO_SCOPE)
return JSONResponse(body.model_dump(exclude_none=True), headers={"cache-control": "no-store"})