modelcontextprotocol/rust-sdk
Watch
1
0
Fork
You've already forked rust-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: preserve transient OAuth discovery HTTP errors (#1071)

Browse source 
* fix: preserve transient OAuth discovery HTTP errors

* fix: preserve HTTP 425 during OAuth discovery
This commit is contained in:
thomas 2026-07-28 12:07:39 -07:00 • committed by GitHub
commit 82a6c48e92
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 87 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

96
crates/rmcp/src/transport/auth.rs
View file

@ -2635,10 +2635,14 @@ impl AuthorizationManager {
request: OAuthHttpRequest,
) -> Result<HttpResponse, OAuthHttpClientError> {
let response = self.http_client.execute(request).await?;
if response.status().is_server_error() {
return Err(Box::new(OAuthHttpError::UnexpectedStatus(
response.status(),
)));
let status = response.status();
if status.is_server_error()
|| matches!(
status,
StatusCode::REQUEST_TIMEOUT | StatusCode::TOO_EARLY | StatusCode::TOO_MANY_REQUESTS
)
{
return Err(Box::new(OAuthHttpError::UnexpectedStatus(status)));
}
Ok(response)
}
@ -3820,6 +3824,7 @@ mod tests {
};
use oauth2::{AuthType, CsrfToken, HttpResponse, PkceCodeVerifier};
use reqwest::StatusCode;
use rstest::rstest;
use url::Url;
@ -3987,6 +3992,74 @@ mod tests {
);
}
#[rstest]
#[case::resource_request_timeout(StatusCode::REQUEST_TIMEOUT, 0, "https://mcp.example.com/mcp")]
#[case::resource_too_early(StatusCode::TOO_EARLY, 0, "https://mcp.example.com/mcp")]
#[case::resource_too_many_requests(
StatusCode::TOO_MANY_REQUESTS,
0,
"https://mcp.example.com/mcp"
)]
#[case::protected_metadata_request_timeout(
StatusCode::REQUEST_TIMEOUT,
1,
"https://mcp.example.com/.well-known/oauth-protected-resource"
)]
#[case::protected_metadata_too_early(
StatusCode::TOO_EARLY,
1,
"https://mcp.example.com/.well-known/oauth-protected-resource"
)]
#[case::protected_metadata_too_many_requests(
StatusCode::TOO_MANY_REQUESTS,
1,
"https://mcp.example.com/.well-known/oauth-protected-resource"
)]
#[case::authorization_request_timeout(
StatusCode::REQUEST_TIMEOUT,
2,
"https://auth.example.com/.well-known/oauth-authorization-server"
)]
#[case::authorization_too_early(
StatusCode::TOO_EARLY,
2,
"https://auth.example.com/.well-known/oauth-authorization-server"
)]
#[case::authorization_too_many_requests(
StatusCode::TOO_MANY_REQUESTS,
2,
"https://auth.example.com/.well-known/oauth-authorization-server"
)]
#[tokio::test]
async fn discovery_propagates_transient_client_errors(
#[case] status: StatusCode,
#[case] successful_response_count: usize,
#[case] expected_url: &str,
) {
let mut responses = preregistered_discovery_responses();
responses.insert(successful_response_count, empty_response(status.as_u16()));
let client = RecordingOAuthHttpClient::with_responses(responses);
let manager = AuthorizationManager::new_with_oauth_http_client(
"https://mcp.example.com/mcp",
Arc::new(client.clone()),
)
.await
.unwrap();
let error = manager.resolve_metadata().await.unwrap_err();
assert!(
matches!(
error,
AuthError::MetadataError(ref reason)
if reason.contains(expected_url) && reason.contains(status.as_str())
),
"unexpected discovery error for {status}: {error}"
);
assert_eq!(client.requests().len(), successful_response_count + 1);
}
#[tokio::test]
async fn custom_http_client_handles_protected_resource_discovery() {
let challenge = oauth2::http::Response::builder()
@ -4330,13 +4403,18 @@ mod tests {
);
}
#[rstest]
#[case::not_found(StatusCode::NOT_FOUND)]
#[case::method_not_allowed(StatusCode::METHOD_NOT_ALLOWED)]
#[tokio::test]
async fn resolve_metadata_reports_legacy_fallback_when_nothing_is_discovered() {
async fn resolve_metadata_reports_legacy_fallback_when_nothing_is_discovered(
#[case] status: StatusCode,
) {
let client = RecordingOAuthHttpClient::with_responses(vec![
empty_response(404),
empty_response(404),
empty_response(404),
empty_response(404),
empty_response(status.as_u16()),
empty_response(status.as_u16()),
empty_response(status.as_u16()),
empty_response(status.as_u16()),
]);
let manager = AuthorizationManager::new_with_oauth_http_client(
"https://legacy.example.com/",