modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

adjust default validation for resource parameter in client flow, and server example

Browse source
This commit is contained in:
Paul Carleton 2025-06-19 17:52:24 +01:00
commit 87da0e0c3a
No known key found for this signature in database
1 changed files with 85 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/examples/server/simpleStreamableHttp.ts
View file

@ -9,6 +9,7 @@ import { CallToolResult, GetPromptResult, isInitializeRequest, PrimitiveSchemaDe
import { InMemoryEventStore } from '../shared/inMemoryEventStore.js';
import { setupAuthServer } from './demoInMemoryOAuthProvider.js';
import { OAuthMetadata } from 'src/shared/auth.js';
import { checkResourceAllowed } from 'src/shared/auth-utils.js';
// Check for OAuth flag
const useOAuth = process.argv.includes('--oauth');
@ -463,7 +464,7 @@ if (useOAuth) {
if (!data.aud) {
throw new Error(`Resource Indicator (RFC8707) missing`);
}
if (data.aud !== mcpServerUrl.href) {
if (!checkResourceAllowed({ requestedResource: data.aud, configuredResource: mcpServerUrl })) {
throw new Error(`Expected resource indicator ${mcpServerUrl}, got: ${data.aud}`);
}
}