modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: preserve exact OAuth resource indicators (#2581)

Browse source 
Co-authored-by: Konstantin Konstantinov <konstantin@mach5technology.com>
This commit is contained in:
Hugo Moreira 2026-09-03 09:36:13 -07:00 • committed by GitHub
commit 5119ee7fd7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 120 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

5
.changeset/plenty-plums-sip.md Normal file
View file

@ -0,0 +1,5 @@
---
'@modelcontextprotocol/client': patch
---
Preserve the exact OAuth resource indicator from protected resource metadata when building authorization and token requests. Previously a pathless `resource` such as `https://example.com` was normalized to `https://example.com/` via `URL.href`, which breaks authorization servers that require the `resource` parameter to match the published value exactly (Microsoft Entra ID rejects it with `AADSTS9010010`). The exported OAuth helpers (`startAuthorization`, `exchangeAuthorization`, `refreshAuthorization`, `fetchToken`, `executeTokenRequest`) now also accept a `string` for `resource`; `selectResourceURL` still returns a `URL`, and a provider's `validateResourceURL` result is used unchanged. Fixes #1968.