From 4fcbb6870bbdd3c582346c7e66887b2660575827 Mon Sep 17 00:00:00 2001
From: Olivier Chafik <ochafik@anthropic.com>
Date: Wed, 18 Jun 2025 11:50:39 +0100
Subject: [PATCH] verify PRM resource

---
 src/client/auth.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/client/auth.ts b/src/client/auth.ts
index 681cde99..5fa2dee2 100644
--- a/src/client/auth.ts
+++ b/src/client/auth.ts
@@ -110,6 +110,9 @@ export async function auth(
     if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
       authorizationServerUrl = resourceMetadata.authorization_servers[0];
     }
+    if (resourceMetadata.resource && resourceMetadata.resource !== resource.href) {
+      throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${resource}`);
+    }
   } catch (error) {
     console.warn("Could not load OAuth Protected Resource metadata, falling back to /.well-known/oauth-authorization-server", error)
   }