Inna Harper
f733207dae
Merge pull request #640 from cliffhall/report-session-id-per-request
...
Show session id per request in simpleStreamableHttp example server
2025-06-25 14:18:49 +01:00
Chris Dickinson
05d98bb3a4
feat(shared/auth): support software_statement in OAuthClientMetadata ( #696 )
...
Per [Section 3.1.1][ref], `software_statement` is an OPTIONAL member
of the client creation request, which may contain a JWT encoding claims
about client software.
[ref]: https://datatracker.ietf.org/doc/html/rfc7591#section-3.1.1
2025-06-25 11:20:26 +01:00
Inna Harper
c40193933a
Merge pull request #655 from Areo-Joe/fix/skip_validate_if_error
...
fix: skip validation if tool reports error
2025-06-24 17:14:11 +01:00
ihrpr
33e03f499e
Merge branch 'main' into fix/skip_validate_if_error
2025-06-24 17:12:34 +01:00
ihrpr
c20a47a79f
small fixes
2025-06-24 17:09:29 +01:00
Inna Harper
600c623fe6
Merge pull request #693 from modelcontextprotocol/pcarleton/resource-only-when-prm-present
...
[auth] refactor resource selection to not include resource if PRM is not present
2025-06-24 15:48:14 +01:00
Paul Carleton
15a2277c89
refactor resource selection to not include resource if PRM is not present
2025-06-24 14:47:54 +01:00
Inna Harper
ebf8e2d029
Merge pull request #692 from modelcontextprotocol/ihrpr/fallback-for-auth-well-known
...
Fallback for` /.well-known/oauth-authorization-server` dropping path
2025-06-24 11:58:53 +01:00
ihrpr
03da7cfc66
fallback
2025-06-24 11:38:55 +01:00
Inna Harper
0fc9bd0a32
Merge pull request #687 from smithery-ai/patch-1
...
Fix `/.well-known/oauth-authorization-server` dropping path
2025-06-24 10:51:49 +01:00
Henry Mao
1ff08e41d7
Add path test
2025-06-23 17:32:08 -04:00
Henry Mao
6220701352
Fix trailing slash
2025-06-23 17:13:13 -04:00
Henry Mao
da6ac79c1e
Fix missing issuer
2025-06-24 04:41:26 +08:00
Henry Mao
4f24b8bc6f
Fix /.well-known/oauth-authorization-server dropping path
2025-06-24 04:36:54 +08:00
Inna Harper
cb4743d0ad
Merge pull request #683 from modelcontextprotocol/ihrpr/1.13.1
...
1.13.1
2025-06-23 14:33:46 +01:00
ihrpr
9c3ef4f944
1.13.1
2025-06-23 14:31:50 +01:00
Inna Harper
0506addf35
Merge pull request #675 from chrisdickinson/chris/20250620-sse-auththenstart
...
fix(client/sse): extract protected resource from eventsource 401
2025-06-20 23:14:30 +01:00
Chris Dickinson
d89e854133
fix(client/sse): extract protected resource from eventsource 401
...
Previously the SSE connection would always default to the
`/.well-known/oauth-protected-resource` URI, ignoring the `resource_metadata`
portion of the `www-authenticate` returned in a 401.
Extract the metadata from the initial 401, so RS servers with
custom protected resource URIs (as in RFC9728, [section 3.1][1]))
continue to work as expected.
[1]: https://datatracker.ietf.org/doc/html/rfc9728#section-3.1
2025-06-20 12:54:29 -07:00
Inna Harper
66b7cd2642
Merge pull request #664 from modelcontextprotocol/pcarleton/auth-resource-validation2
...
[auth] adjust default validation for resource parameter in client flow, and server example
2025-06-20 08:54:12 +01:00
Inna Harper
19103582ab
Merge pull request #668 from modelcontextprotocol/ashwin/logremoval
...
feat: remove console statements from SDK code
2025-06-20 08:51:19 +01:00
Ashwin Bhat
f4b8a48ded
feat: remove console statements from SDK code
...
- Remove all console.log, console.warn, and console.error from src/client and src/server
- Add ESLint no-console rule for client and server directories (excluding tests)
- Keep console statements in test files, examples, and CLI tools as intended
Addresses feedback in PR #665
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-19 22:36:33 -07:00
Olivier Chafik
744b9eade6
build: add watching script targets for build & simple streamable http server ( #663 )
2025-06-19 18:56:25 +01:00
Paul Carleton
eff548c06f
adjust to provided resource
2025-06-19 18:02:00 +01:00
Paul Carleton
87da0e0c3a
adjust default validation for resource parameter in client flow, and server example
2025-06-19 17:52:24 +01:00
Olivier Chafik
2a238905df
simpleStreamableHttp: fix example code ( #660 )
2025-06-19 11:44:43 +01:00
Inna Harper
a68dcdf452
Merge pull request #659 from modelcontextprotocol/ihrpr/1.13.0
...
bump version to 1.13.0
2025-06-18 20:36:35 +01:00
Inna Harper
00a631c2ce
Merge pull request #657 from modelcontextprotocol/ihrpr/decline-reject
...
rename decline to reject
2025-06-18 20:35:42 +01:00
ihrpr
2f9530bdf9
fix typo
2025-06-18 20:33:35 +01:00
ihrpr
54a8556696
bump version
2025-06-18 20:21:24 +01:00
ihrpr
e7a5e331f1
rename decline to reject
2025-06-18 20:11:18 +01:00
Inna Harper
90569d885f
Merge pull request #638 from modelcontextprotocol/ochafik/auth-resource
...
RFC 8707 Resource Indicators Implementation
2025-06-18 17:34:37 +01:00
Paul Carleton
86bed6aaac
adjust comment
2025-06-18 16:05:14 +01:00
Paul Carleton
4c51230fc2
fix tests
2025-06-18 16:00:12 +01:00
Paul Carleton
dada5f66f5
wip helper func
2025-06-18 15:52:56 +01:00
Olivier Chafik
f854b58443
test validateProtectedResourceMetadata override
2025-06-18 15:26:58 +01:00
Olivier Chafik
4b3db9bbeb
stricter PRM check overridable w/ OAuthClientProvider.validateProtectedResourceMetadata
2025-06-18 15:06:16 +01:00
joeyzzeng
e76faf6a18
fix: skip validation if tool reports error
2025-06-18 21:34:42 +08:00
Olivier Chafik
3f07bdb223
shrink tests
2025-06-18 13:32:45 +01:00
Olivier Chafik
f0ea31cff9
Update auth.test.ts
2025-06-18 13:20:58 +01:00
Olivier Chafik
a7f9c59401
Fix SSE test resource URL validation errors
...
Fixed 5 instances of hardcoded "https://resource.example.com " in OAuth
protected resource metadata mocks to use the actual resourceBaseUrl.href.
This resolves test failures where the auth validation was rejecting
requests because the resource URL in the metadata didn't match the
actual test server URL.
The failing tests were:
- attempts auth flow on 401 during SSE connection
- attempts auth flow on 401 during POST request
- refreshes expired token during SSE connection
- refreshes expired token during POST request
- redirects to authorization if refresh token flow fails
All SSE tests now pass (17/17).
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-18 13:16:32 +01:00
Olivier Chafik
bac384f242
simplify tests
2025-06-18 12:23:48 +01:00
Olivier Chafik
354318f147
auth: don't fail the prm if the resource doesn't match
2025-06-18 12:14:57 +01:00
Olivier Chafik
5c60c77c93
shrink diff
2025-06-18 12:09:00 +01:00
Olivier Chafik
6a01d0d4a5
shrink token.test.ts
2025-06-18 12:07:38 +01:00
Olivier Chafik
9e2a565164
minimize changes
2025-06-18 12:01:51 +01:00
Olivier Chafik
68424ef7e6
simplify changes
2025-06-18 11:59:19 +01:00
Olivier Chafik
4fcbb6870b
verify PRM resource
2025-06-18 11:50:39 +01:00
Olivier Chafik
e5b2a5b880
fix simpleStreamableHttp.ts
2025-06-18 11:50:29 +01:00
Olivier Chafik
8475e43f15
drop redundant resource canonicalization tests
2025-06-18 11:48:20 +01:00
Olivier Chafik
b77361bd14
Update streamableHttp.ts
2025-06-18 11:41:35 +01:00
