[v1.x] Follow redirects only within the MCP endpoint's origin (#3448)

examples/clients/simple-auth-client/mcp_simple_auth_client/main.py

@@ -212,7 +212,7 @@ class SimpleAuthClient:
                     await self._run_session(read_stream, write_stream, None)
             else:
                 print("📡 Opening StreamableHTTP transport connection with auth...")
-                async with httpx.AsyncClient(auth=oauth_auth, follow_redirects=True) as custom_client:
+                async with httpx.AsyncClient(auth=oauth_auth) as custom_client:
                     async with streamable_http_client(
                         url=self.server_url,
                         http_client=custom_client,

examples/servers/simple-tool/mcp_simple_tool/server.py

@@ -2,9 +2,9 @@ from typing import Any
 
 import anyio
 import click
+import httpx
 import mcp.types as types
 from mcp.server.lowlevel import Server
-from mcp.shared._httpx_utils import create_mcp_http_client
 from starlette.requests import Request
 
 
@@ -12,7 +12,8 @@ async def fetch_website(
     url: str,
 ) -> list[types.ContentBlock]:
     headers = {"User-Agent": "MCP Test Server (github.com/modelcontextprotocol/python-sdk)"}
-    async with create_mcp_http_client(headers=headers) as client:
+    timeout = httpx.Timeout(30, read=300)
+    async with httpx.AsyncClient(headers=headers, timeout=timeout, follow_redirects=True) as client:
         response = await client.get(url)
         response.raise_for_status()
         return [types.TextContent(type="text", text=response.text)]

examples/snippets/clients/oauth_client.py

@@ -69,7 +69,7 @@ async def main():
         callback_handler=handle_callback,
     )
 
-    async with httpx.AsyncClient(auth=oauth_auth, follow_redirects=True) as custom_client:
+    async with httpx.AsyncClient(auth=oauth_auth) as custom_client:
         async with streamable_http_client("http://localhost:8001/mcp", http_client=custom_client) as (read, write, _):
             async with ClientSession(read, write) as session:
                 await session.initialize()