8000 [auth] adjust default validation for resource parameter in client flow, and server example by pcarleton · Pull Request #664 · modelcontextprotocol/typescript-sdk · GitHub
[go: up one dir, main page]
Skip to content

[auth] adjust default validation for resource parameter in client flow, and server example #664

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Jun 20, 2025
Merged

[auth] adjust default validation for resource parameter in client flow, and server example #664

merged 2 commits into from
Jun 20, 2025

Conversation

pcarleton
Copy link
Contributor

Motivation and Context

In the previous PR, we required strict matching for resource parameter between the requested server url like https://mcp.example.com/mcp so we would fail if the metadata suggested a resource of https://mcp.example.com. However, the server is free to define the resource it wants to request, and will be the one checking on the server end, so if the resource metadata says a hierarchically lower URL, then we should use that instead of the more specific one, and not reject it.

This also exposes selectResource function, to make it easier to leverage in e.g. auth debugger.

How Has This Been Tested?

Added more tests

Breaking Changes

This should be more lenient, so not a breaking change.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

@pcarleton pcarleton requested a review from ochafik June 19, 2025 17:05
ochafik
ochafik approved these changes Jun 19, 2025
View reviewed changes
Copy link
Contributor
@ochafik ochafik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!

@ihrpr ihrpr merged commit 66b7cd2 into main Jun 20, 2025
5 checks passed
@ihrpr ihrpr deleted the pcarleton/auth-resource-validation2 branch June 20, 2025 07:54
@pcarleton pcarleton mentioned this pull request Jun 20, 2025
Open
9 tasks
@ihrpr ihrpr mentioned this pull request Jun 20, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ochafik ochafik ochafik approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@pcarleton @ochafik @ihrpr
0