modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Fix oauth-protected-resource to also be path aware

Browse source
This commit is contained in:
Henry Mao 2025-07-04 11:10:07 +08:00 • committed by GitHub
commit abcf91b463
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/client/auth.ts
View file

@ -261,7 +261,9 @@ export async function discoverOAuthProtectedResourceMetadata(
if (opts?.resourceMetadataUrl) {
url = new URL(opts?.resourceMetadataUrl);
} else {
url = new URL("/.well-known/oauth-protected-resource", serverUrl);
const issuer = new URL(serverUrl);
const wellKnownPath = buildWellKnownPath('oauth-protected-resource', issuer.pathname);
url = new URL(wellKnownPath, issuer);
}
let response: Response;
@ -318,8 +320,8 @@ async function fetchWithCorsRetry(
/**
* Constructs the well-known path for OAuth metadata discovery
*/
function buildWellKnownPath(pathname: string): string {
let wellKnownPath = `/.well-known/oauth-authorization-server${pathname}`;
function buildWellKnownPath(wellKnownPath: string, pathname: string): string {
let wellKnownPath = `/.well-known/${wellKnownPath}${pathname}`;
if (pathname.endsWith('/')) {
// Strip trailing slash from pathname to avoid double slashes
wellKnownPath = wellKnownPath.slice(0, -1);
@ -361,7 +363,7 @@ export async function discoverOAuthMetadata(
const protocolVersion = opts?.protocolVersion ?? LATEST_PROTOCOL_VERSION;
// Try path-aware discovery first (RFC 8414 compliant)
const wellKnownPath = buildWellKnownPath(issuer.pathname);
const wellKnownPath = buildWellKnownPath('oauth-authorization-server', issuer.pathname);
const pathAwareUrl = new URL(wellKnownPath, issuer);
let response = await tryMetadataDiscovery(pathAwareUrl, protocolVersion);