fix(mcp-oauth): remove dead userinfo check in redirect_uri validation

cursoragent · yassin-berriai · cursoragent · commit a31111e8d7de · 2026-05-21T13:24:54.000Z
The first check combined missing netloc with userinfo presence, making
the second userinfo-only check unreachable. Split into two distinct
checks so each error message reflects the actual failure mode.

Co-authored-by: Yassin Kortam &lt;yassin@berri.ai&gt;
diff --git a/litellm/proxy/_experimental/mcp_server/oauth_utils.py b/litellm/proxy/_experimental/mcp_server/oauth_utils.py
@@ -345,9 +345,9 @@ def _validate_trusted_http_redirect_shape(parsed: ParseResult) -> bool:
         _oauth_invalid_request(
             "redirect_uri must not contain a URL fragment (#...).",
         )
-    if not parsed.netloc or parsed.username is not None or parsed.password is not None:
+    if not parsed.netloc:
         _oauth_invalid_request(
-            "redirect_uri must include a host and must not contain userinfo (user:pass@host).",
+            "redirect_uri must include a host (e.g. https://your-host/path).",
         )
     if parsed.username is not None or parsed.password is not None:
         _oauth_invalid_request(

Original file line number	Diff line number	Diff line change
`@@ -345,9 +345,9 @@ def _validate_trusted_http_redirect_shape(parsed: ParseResult) -> bool:`
`345`	`345`	`_oauth_invalid_request(`
`346`	`346`	`"redirect_uri must not contain a URL fragment (#...).",`
`347`	`347`	`)`
`348`		`- if not parsed.netloc or parsed.username is not None or parsed.password is not None:`
	`348`	`+ if not parsed.netloc:`
`349`	`349`	`_oauth_invalid_request(`
`350`		`- "redirect_uri must include a host and must not contain userinfo (user:pass@host).",`
	`350`	`+ "redirect_uri must include a host (e.g. https://your-host/path).",`
`351`	`351`	`)`
`352`	`352`	`if parsed.username is not None or parsed.password is not None:`
`353`	`353`	`_oauth_invalid_request(`