Skip to content

Fall back to well-known URL in client if 401 response is missing resource_metadata parameter #1054

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
halter73 merged 6 commits into from
Dec 5, 2025
Merged

Fall back to well-known URL in client if 401 response is missing resource_metadata parameter #1054

halter73 merged 6 commits into from
Dec 5, 2025

Conversation

@halter73
Copy link
Contributor

@halter73 halter73 commented Dec 3, 2025 •
edited
Loading

Implements SEP-985 (modelcontextprotocol/modelcontextprotocol#971)

  • Automatically infer resource URI by default in McpAuthenticationHandler
  • Fix matching absolute resource URI in McpAuthenticationHandler if specified
  • Add MockLoggerProvider to LoggedTest.cs

Fixes #773

Replaces #937 @sr-auto
Replaces #1041 @ptrstr

@halter73
Fall back to well-known URL in client if 401 response is missing reso…
ab5daed 
…urce_metadata parameter

- Automatically infer resource URI by default in McpAuthenticationHandler
- Fix matching absolute resource URI in McpAuthenticationHandler if specified
- Add MockLoggerProvider to LoggedTest.cs
Copilot AI reviewed Dec 3, 2025
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request implements a fallback mechanism for OAuth resource metadata discovery when the 401 response doesn't include a resource_metadata parameter in the WWW-Authenticate header. The client now automatically constructs a well-known URL based on the requested resource URI, and the server handler automatically infers the resource URI from the request path when serving the default metadata endpoint.

Key changes:

  • Made ProtectedResourceMetadata.Resource nullable to support automatic inference
  • Client falls back to /.well-known/oauth-protected-resource/<resource-path> when WWW-Authenticate header is missing or doesn't include resource_metadata
  • Server handler now automatically derives resource URI from request path suffix when using the default metadata endpoint pattern
  • Centralized MockLoggerProvider in LoggedTest base class for improved test infrastructure

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
src/ModelContextProtocol.Core/Authentication/ProtectedResourceMetadata.cs Made Resource property nullable to support automatic inference by handler
src/ModelContextProtocol.Core/Authentication/ClientOAuthProvider.cs Added fallback logic to build metadata URI from resource URI when WWW-Authenticate header missing/incomplete; added logging for fallback scenarios
src/ModelContextProtocol.AspNetCore/Authentication/McpAuthenticationOptions.cs Made ResourceMetadataUri nullable to support automatic default endpoint pattern
src/ModelContextProtocol.AspNetCore/Authentication/McpAuthenticationHandler.cs Implemented automatic resource URI inference from request path; added path base support; improved endpoint matching logic with host/scheme validation
tests/Common/Utils/LoggedTest.cs Added MockLoggerProvider property to base class for centralized test logging infrastructure
tests/Common/Utils/MockLoggerProvider.cs Removed unnecessary primary constructor syntax
tests/ModelContextProtocol.Tests/ClientServerTestBase.cs Registered MockLoggerProvider in DI container
tests/ModelContextProtocol.Tests/Configuration/McpServerBuilderExtensionsToolsTests.cs Updated to use inherited MockLoggerProvider property; removed manual instantiation
tests/ModelContextProtocol.Tests/Configuration/McpServerBuilderExtensionsFilterTests.cs Updated to use inherited MockLoggerProvider property; removed manual instantiation
tests/ModelContextProtocol.AspNetCore.Tests/Utils/KestrelInMemoryTest.cs Registered MockLoggerProvider and set minimum log level to Debug
tests/ModelContextProtocol.AspNetCore.Tests/OAuth/OAuthTestBase.cs Removed explicit Resource setting from metadata; added support for path and auth scheme parameters
tests/ModelContextProtocol.AspNetCore.Tests/OAuth/McpAuthenticationHandlerTests.cs New comprehensive test suite for authentication handler covering relative/absolute URIs, path base, host/scheme validation, and resource inference
tests/ModelContextProtocol.AspNetCore.Tests/OAuth/AuthTests.cs Added tests for authentication without resource_metadata in header, with path suffix support
tests/ModelContextProtocol.AspNetCore.Tests/MapMcpTests.cs Updated to use inherited MockLoggerProvider; simplified test setup
tests/ModelContextProtocol.AspNetCore.Tests/AuthorizeAttributeTests.cs Updated to use inherited MockLoggerProvider; removed manual clearing calls
tests/ModelContextProtocol.TestOAuthServer/Program.cs Added /mcp path to ValidResources for test support
samples/ProtectedMcpServer/Program.cs Removed explicit Resource setting, relying on automatic inference

@halter73 halter73 mentioned this pull request Dec 3, 2025
Closed
11 tasks
stephentoub
stephentoub approved these changes Dec 4, 2025
View reviewed changes
@halter73 halter73 merged commit 9702079 into main Dec 5, 2025
10 checks passed
@halter73 halter73 deleted the halter73/773 branch December 5, 2025 22:12
@jeffhandley jeffhandley added the breaking-change This issue or PR introduces a breaking change label Dec 5, 2025
@halter73 halter73 mentioned this pull request Dec 12, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@stephentoub stephentoub stephentoub approved these changes

@MackinnonBuck MackinnonBuck Awaiting requested review from MackinnonBuck

@localden localden Awaiting requested review from localden

Assignees

No one assigned

Labels

breaking-change This issue or PR introduces a breaking change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

SEP-985: Align OAuth 2.0 Protected Resource Metadata with RFC 9728

4 participants

@halter73 @stephentoub @jeffhandley