modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: continue OAuth metadata discovery on 5xx responses (#1632)

Browse source 
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
This commit is contained in:
Matan Tsach 2026-03-30 22:11:19 +03:00 • committed by GitHub
commit d99f3ee527
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 115 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

11
packages/client/src/client/auth.ts
View file

@ -1035,7 +1035,9 @@ async function tryMetadataDiscovery(url: URL, protocolVersion: string, fetchFn:
* Determines if fallback to root discovery should be attempted
*/
function shouldAttemptFallback(response: Response | undefined, pathname: string): boolean {
return !response || (response.status >= 400 && response.status < 500 && pathname !== '/');
if (!response) return true; // CORS error — always try fallback
if (pathname === '/') return false; // Already at root
return (response.status >= 400 && response.status < 500) || response.status === 502;
}
/**
@ -1062,7 +1064,7 @@ async function discoverMetadataWithFallback(
let response = await tryMetadataDiscovery(url, protocolVersion, fetchFn);
// If path-aware discovery fails with 404 and we're not already at root, try fallback to root discovery
// If path-aware discovery fails (4xx or 502 Bad Gateway) and we're not already at root, try fallback to root discovery
if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) {
const rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);
@ -1230,9 +1232,8 @@ export async function discoverAuthorizationServerMetadata(
if (!response.ok) {
await response.text?.().catch(() => {});
// Continue looking for any 4xx response code.
if (response.status >= 400 && response.status < 500) {
continue; // Try next URL
if ((response.status >= 400 && response.status < 500) || response.status === 502) {
continue; // Try next URL for 4xx or 502 (Bad Gateway)
}
throw new Error(
`HTTP ${response.status} trying to load ${type === 'oauth' ? 'OAuth' : 'OpenID provider'} metadata from ${endpointUrl}`