modelcontextprotocol/python-sdk
Watch
1
0
Fork
You've already forked python-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: use exact match for loopback hosts in issuer URL validation (#2089)

Browse source
This commit is contained in:
Max Isbey 2026-02-18 19:40:52 +00:00 • committed by GitHub
commit 0e96aecd1d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 52 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/mcp/server/auth/routes.py
View file

@ -31,19 +31,15 @@ def validate_issuer_url(url: AnyHttpUrl):
ValueError: If the issuer URL is invalid
"""
# RFC 8414 requires HTTPS, but we allow localhost HTTP for testing
if (
url.scheme != "https"
and url.host != "localhost"
and (url.host is not None and not url.host.startswith("127.0.0.1"))
):
raise ValueError("Issuer URL must be HTTPS") # pragma: no cover
# RFC 8414 requires HTTPS, but we allow loopback/localhost HTTP for testing
if url.scheme != "https" and url.host not in ("localhost", "127.0.0.1", "[::1]"):
raise ValueError("Issuer URL must be HTTPS")
# No fragments or query parameters allowed
if url.fragment:
raise ValueError("Issuer URL must not have a fragment") # pragma: no cover
raise ValueError("Issuer URL must not have a fragment")
if url.query:
raise ValueError("Issuer URL must not have a query string") # pragma: no cover
raise ValueError("Issuer URL must not have a query string")
AUTHORIZATION_PATH = "/authorize"