Skip to content

fix: fix OAuth flow request object handling #1174

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jul 21, 2025
Merged

fix: fix OAuth flow request object handling #1174

merged 1 commit into from
Jul 21, 2025

Conversation

clareliguori
Copy link
Contributor

@clareliguori clareliguori commented Jul 19, 2025 •
edited
Loading

Motivation and Context

Fixes #1173

How Has This Been Tested?

New unit test fails before change and succeeds after

Example unit test failure before the change, highlighting the request handling bug:

       # Final request should be the original request with auth header
        final_request = await auth_flow.asend(token_response)
        assert final_request.headers["Authorization"] == "Bearer new_access_token"
        assert final_request.method == "GET"
>       assert str(final_request.url) == "https://api.example.com/mcp"
E       AssertionError: assert 'https://auth...zation-server' == 'https://api.example.com/mcp'
E         
E         - https://api.example.com/mcp
E         + https://auth.example.com/.well-known/oauth-authorization-server

tests/client/test_auth.py:581: AssertionError

Breaking Changes

No

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

@clareliguori clareliguori changed the title DRAFT: fix for OAuth request bug fix: fix OAuth flow request handling Jul 19, 2025
@clareliguori clareliguori marked this pull request as ready for review July 19, 2025 04:53
@clareliguori clareliguori requested review from a team, ihrpr and pcarleton July 19, 2025 04:53
@clareliguori clareliguori changed the title fix: fix OAuth flow request handling fix: fix OAuth flow request object handling Jul 19, 2025
@ihrpr ihrpr added this to the auth milestone Jul 21, 2025
ihrpr
ihrpr approved these changes Jul 21, 2025
View reviewed changes
Copy link
Contributor

@ihrpr ihrpr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks so much for the fix!

@ihrpr ihrpr merged commit 6a84a2f into modelcontextprotocol:main Jul 21, 2025
10 checks passed
@clareliguori clareliguori deleted the oauth-request-bug branch July 21, 2025 13:33
saqadri pushed a commit to saqadri/stdio-fixes that referenced this pull request Aug 6, 2025
@clareliguori @saqadri
fix: fix OAuth flow request object handling (modelcontextprotocol#1174)
2de62fd
rbehal pushed a commit to gumloop/gumloop-mcp that referenced this pull request Sep 25, 2025
@dvlpjrs @felixweinberger
@yurikunash @pamelafox @ihrpr @Kludex @davenpi @functicons @dingo4dev @LucaButBoring @only-weng @clareliguori @lukacf @chughtapan @yannj-fr @pcarleton @sreenaths @jbkkd @joesavage-silabs @glinf @dsp-ant @mous222 @maxisbey @claude @jerome3o-anthropic @dragonier23 @keurcien @timesler @sandangel @justin-yi-wang @monkeywithacupcake @pja-ant @reidg44 @eleftherias @cclauss @pchoudhury22 @owengo @olivierhub @stevebillings @mssalvatore
[GMLP-5458] Sync upstream (#5)
0206b4d 
* Add regression test for stateless request memory cleanup (modelcontextprotocol#1140)

* Implement RFC9728 - Support WWW-Authenticate header by MCP client (modelcontextprotocol#1071)

* Add streamable HTTP starlette example to Python SDK docs (modelcontextprotocol#1111)

* fix markdown error in README in main (modelcontextprotocol#1147)

* README - replace code snippets with examples - add lowlevel to snippets (modelcontextprotocol#1150)

* README - replace code snippets with examples - streamable http (modelcontextprotocol#1155)

* chore: don't allow users to create issues outside the templates (modelcontextprotocol#1163)

* Tests(cli): Add coverage for helper functions (modelcontextprotocol#635)

* Docs: Update CallToolResult parsing in README (modelcontextprotocol#812)

Co-authored-by: Felix Weinberger <[email protected]>

* docs: add pre-commit install guide on CONTRIBUTING.md (modelcontextprotocol#995)

Co-authored-by: Felix Weinberger <[email protected]>

* fix flaky fix-test_streamablehttp_client_resumption test (modelcontextprotocol#1166)

* README - replace code snippets with examples -- auth examples (modelcontextprotocol#1164)

* Support falling back to OIDC metadata for auth (modelcontextprotocol#1061)

* Add CODEOWNERS file for sdk (modelcontextprotocol#1169)

* fix flaky test test_88_random_error (modelcontextprotocol#1171)

* Make sure `RequestId` is not coerced as `int` (modelcontextprotocol#1178)

* Fix: Replace threading.Lock with anyio.Lock for Ray deployment compatibility (modelcontextprotocol#1151)

* fix: fix OAuth flow request object handling (modelcontextprotocol#1174)

* update codeowners group (modelcontextprotocol#1191)

* fix: perform auth server metadata discovery fallbacks on any 4xx (modelcontextprotocol#1193)

* server: skip duplicate response on CancelledError (modelcontextprotocol#1153)

Co-authored-by: ihrpr <[email protected]>

* Unpack settings in FastMCP (modelcontextprotocol#1198)

* chore: Remove unused prompt_manager.py file (modelcontextprotocol#1229)

Co-authored-by: Tapan Chugh <[email protected]>

* Improved supported for ProtectedResourceMetadata (modelcontextprotocol#1235)

Co-authored-by: Paul Carleton <[email protected]>

* chore: Remove unused variable notification_options (modelcontextprotocol#1238)

* Improve README around the Context object (modelcontextprotocol#1203)

* fix: allow to pass `list[str]` to `token_endpoint_auth_signing_alg_values_supported` (modelcontextprotocol#1226)

* Remove strict validation on `response_modes_supported` member of `OAuthMetadata` (modelcontextprotocol#1243)

* Add pyright strict mode on the whole project (modelcontextprotocol#1254)

* Consistent casing for default headers Accept and Content-Type (modelcontextprotocol#1263)

* Update dependencies and fix type issues (modelcontextprotocol#1268)

Co-authored-by: Marcelo Trylesinski <[email protected]>

* fix: prevent async generator cleanup errors in StreamableHTTP transport (modelcontextprotocol#1271)

Co-authored-by: David Soria Parra <[email protected]>

* chore: uncomment .idea/ in .gitignore (modelcontextprotocol#1287)

Co-authored-by: Claude <[email protected]>

* docs: clarify streamable_http_path configuration when mounting servers (modelcontextprotocol#1172)

* feat: Add CORS configuration for browser-based MCP clients (modelcontextprotocol#1059)

Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Added Audio to FastMCP (modelcontextprotocol#1130)

* fix: avoid uncessary retries in OAuth authenticated requests (modelcontextprotocol#1206)

Co-authored-by: Felix Weinberger <[email protected]>

* Add PATHEXT to default STDIO env vars in windows (modelcontextprotocol#1256)

* fix: error too many values to unpack (expected 2) (modelcontextprotocol#1279)

Signed-off-by: San Nguyen <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* SDK Parity: Avoid Parsing Server Response for non-JsonRPCMessage Requests (modelcontextprotocol#1290)

* types: Setting default value for method: Literal (modelcontextprotocol#1292)

* changes structured temperature to not deadly (modelcontextprotocol#1328)

* Update simple-resource example to use non-deprecated read_resource return type (modelcontextprotocol#1331)

Co-authored-by: Claude <[email protected]>

* docs: Update README to include link to API docs for modelcontextprotocol#1329 (modelcontextprotocol#1330)

* Allow ping requests before initialization (modelcontextprotocol#1312)

* Python lint: Ruff rules for pylint and code complexity (modelcontextprotocol#525)

* Fix context injection for resources and prompts (modelcontextprotocol#1336)

* fix(fastmcp): propagate mimeType in resource template list (modelcontextprotocol#1186)

Co-authored-by: Felix Weinberger <[email protected]>

* fix: allow elicitations accepted without content (modelcontextprotocol#1285)

Co-authored-by: Olivier Schiavo <[email protected]>

* Use --frozen in pre-commit config (modelcontextprotocol#1375)

* Return HTTP 403 for invalid Origin headers (modelcontextprotocol#1353)

* Add test for ProtectedResourceMetadataParsing (modelcontextprotocol#1236)

Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Fastmcp logging progress example (modelcontextprotocol#1270)

Co-authored-by: Felix Weinberger <[email protected]>

* feat: add paginated list decorators for prompts, resources, and tools (modelcontextprotocol#1286)

Co-authored-by: Claude <[email protected]>

* Remove "unconditionally" from conditional description (modelcontextprotocol#1289)

* Use streamable-http consistently in examples (modelcontextprotocol#1389)

* feat: Add SDK support for SEP-1034 default values in elicitation schemas (modelcontextprotocol#1337)

Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Implementation of SEP 973 - Additional metadata + icons support (modelcontextprotocol#1357)

* Merge upstream/main with custom filtering

---------

Signed-off-by: San Nguyen <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: yurikunash <[email protected]>
Co-authored-by: Pamela Fox <[email protected]>
Co-authored-by: Inna Harper <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Ian Davenport <[email protected]>
Co-authored-by: Dagang Wei <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Stanley Law <[email protected]>
Co-authored-by: Luca Chang <[email protected]>
Co-authored-by: leweng <[email protected]>
Co-authored-by: Clare Liguori <[email protected]>
Co-authored-by: lukacf <[email protected]>
Co-authored-by: ihrpr <[email protected]>
Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Yann Jouanin <[email protected]>
Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Sreenath Somarajapuram <[email protected]>
Co-authored-by: Omer Korner <[email protected]>
Co-authored-by: joesavage-silabs <[email protected]>
Co-authored-by: Gregory L <[email protected]>
Co-authored-by: David Soria Parra <[email protected]>
Co-authored-by: Moustapha Ebnou <[email protected]>
Co-authored-by: Max Isbey <[email protected]>
Co-authored-by: Claude <[email protected]>
Co-authored-by: Jerome <[email protected]>
Co-authored-by: xavier <[email protected]>
Co-authored-by: keurcien <[email protected]>
Co-authored-by: Tim Esler <[email protected]>
Co-authored-by: San Nguyen <[email protected]>
Co-authored-by: Justin Wang <[email protected]>
Co-authored-by: jess <[email protected]>
Co-authored-by: Peter Alexander <[email protected]>
Co-authored-by: Reid Geyer <[email protected]>
Co-authored-by: Eleftheria Stein-Kousathana <[email protected]>
Co-authored-by: Christian Clauss <[email protected]>
Co-authored-by: pchoudhury22 <[email protected]>
Co-authored-by: owengo <[email protected]>
Co-authored-by: Olivier Schiavo <[email protected]>
Co-authored-by: Steve Billings <[email protected]>
Co-authored-by: Mike Salvatore <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ihrpr ihrpr ihrpr approved these changes

@pcarleton pcarleton Awaiting requested review from pcarleton

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

OAuth Improvements & Fixes

Development

Successfully merging this pull request may close these issues.

Response parsing errors after OAuth flow

2 participants

@clareliguori @ihrpr