();
-
- // Start an HTTP listener to listen for the authorization code
- using var listener = new System.Net.HttpListener();
-
- // Ensure the URI format is correct for HttpListener
- var listenerPrefix = $"http://{hostname}:{listenPort}/";
- if (redirectPath.Length > 1)
+ // Ensure the path has a trailing slash for the HttpListener prefix
+ string listenerPrefix = $"http://{hostname}:{listenPort}{redirectPath}";
+ if (!listenerPrefix.EndsWith("/"))
{
- // If path is something like "/callback", we need to listen on all paths that start with it
- var basePath = redirectPath.TrimEnd('/').TrimStart('/');
- listenerPrefix = $"http://{hostname}:{listenPort}/{basePath}/";
+ listenerPrefix += "/";
}
-
+
+ using var listener = new HttpListener();
listener.Prefixes.Add(listenerPrefix);
- listener.Start();
- // Default HTML responses
- var defaultSuccessHtml = "Authorization Successful
You can now close this window and return to the application.
";
- var defaultErrorHtml = "Authorization Failed
Error: {0}
";
+ // Start the listener BEFORE opening the browser
+ try
+ {
+ listener.Start();
+ }
+ catch (HttpListenerException ex)
+ {
+ throw new McpException($"Failed to start HTTP listener on {listenerPrefix}: {ex.Message}", McpErrorCode.InvalidRequest);
+ }
+
+ // Create a cancellation token source with a timeout
+ using var cts = new CancellationTokenSource(TimeSpan.FromMinutes(5));
- // Start listening for the callback asynchronously
- var listenerTask = Task.Run(async () =>
+ _ = Task.Run(async () =>
{
try
{
- var context = await listener.GetContextAsync();
- var request = context.Request;
-
- // Get the authorization code from the query string
- var code = request.QueryString["code"];
- var error = request.QueryString["error"];
+ // GetContextAsync doesn't accept a cancellation token, so we need to handle cancellation manually
+ var contextTask = listener.GetContextAsync();
+ var completedTask = await Task.WhenAny(contextTask, Task.Delay(Timeout.Infinite, cts.Token));
- // Send a response to the browser
- var response = context.Response;
- response.ContentType = "text/html";
- string responseHtml;
-
- if (!string.IsNullOrEmpty(error))
+ if (completedTask == contextTask)
{
- responseHtml = string.Format(errorHtml ?? defaultErrorHtml, error);
- authCodeTcs.SetException(new McpException($"Authorization failed: {error}", McpErrorCode.InvalidRequest));
- }
- else if (string.IsNullOrEmpty(code))
- {
- responseHtml = string.Format(errorHtml ?? defaultErrorHtml, "No authorization code received");
- authCodeTcs.SetException(new McpException("No authorization code received", McpErrorCode.InvalidRequest));
- }
- else
- {
- responseHtml = successHtml ?? defaultSuccessHtml;
- authCodeTcs.SetResult(code);
+ var context = await contextTask;
+ var request = context.Request;
+ var response = context.Response;
+
+ string? code = request.QueryString["code"];
+ string? error = request.QueryString["error"];
+ string html;
+ string? resultCode = null;
+
+ if (!string.IsNullOrEmpty(error))
+ {
+ html = $"Authorization Failed
Error: {WebUtility.HtmlEncode(error)}
";
+ }
+ else if (string.IsNullOrEmpty(code))
+ {
+ html = "Authorization Failed
No authorization code received.
";
+ }
+ else
+ {
+ html = "Authorization Successful
You may now close this window.
";
+ resultCode = code;
+ }
+
+ try
+ {
+ // Send response to browser
+ byte[] buffer = Encoding.UTF8.GetBytes(html);
+ response.ContentType = "text/html";
+ response.ContentLength64 = buffer.Length;
+ response.OutputStream.Write(buffer, 0, buffer.Length);
+
+ // IMPORTANT: Explicitly close the response to ensure it's fully sent
+ response.Close();
+
+ // Now that we've finished processing the browser response,
+ // we can safely signal completion or failure with the auth code
+ if (resultCode != null)
+ {
+ authCodeTcs.TrySetResult(resultCode);
+ }
+ else if (!string.IsNullOrEmpty(error))
+ {
+ authCodeTcs.TrySetException(new McpException($"Authorization failed: {error}", McpErrorCode.InvalidRequest));
+ }
+ else
+ {
+ authCodeTcs.TrySetException(new McpException("No authorization code received", McpErrorCode.InvalidRequest));
+ }
+ }
+ catch (Exception ex)
+ {
+ authCodeTcs.TrySetException(new McpException($"Error processing browser response: {ex.Message}", McpErrorCode.InvalidRequest));
+ }
}
-
- var buffer = System.Text.Encoding.UTF8.GetBytes(responseHtml);
- response.ContentLength64 = buffer.Length;
- await response.OutputStream.WriteAsync(buffer, 0, buffer.Length);
- response.Close();
}
catch (Exception ex)
{
authCodeTcs.TrySetException(ex);
}
- finally
- {
- listener.Close();
- }
});
-
- // Open the authorization URL in the browser
- if (clientMetadata.ClientUri != null)
+
+ // Now open the browser AFTER the listener is started
+ if (!string.IsNullOrEmpty(clientMetadata.ClientUri))
{
- await openBrowser(clientMetadata.ClientUri);
+ await openBrowser(clientMetadata.ClientUri!);
}
else
{
- authCodeTcs.SetException(new McpException("No authorization URL provided in client metadata", McpErrorCode.InvalidRequest));
+ // Stop the listener before throwing
+ listener.Stop();
+ throw new McpException("Client URI is missing in metadata.", McpErrorCode.InvalidRequest);
+ }
+
+ try
+ {
+ // Use a timeout to avoid hanging indefinitely
+ string authCode = await authCodeTcs.Task.WaitAsync(cts.Token);
+ return (redirectUri, authCode);
+ }
+ catch (OperationCanceledException)
+ {
+ throw new McpException("Authorization timed out after 5 minutes.", McpErrorCode.InvalidRequest);
+ }
+ finally
+ {
+ // Ensure the listener is stopped when we're done
+ listener.Stop();
}
-
- // Wait for the authorization code
- var code = await authCodeTcs.Task;
-
- return (redirectUri, code);
};
}
From 2f44765b267756175764294a453969e8a9776ac2 Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 24 Apr 2025 00:02:24 -0700
Subject: [PATCH 13/28] Update with proper token logic
---
samples/AuthorizationExample/Program.cs | 2 +
samples/AuthorizationServerExample/Program.cs | 7 +-
.../AuthorizationMiddleware.cs | 9 +-
.../McpServerAuthorizationExtensions.cs | 7 +-
.../Auth/DefaultAuthorizationHandler.cs | 5 +-
.../Transport/SseClientSessionTransport.cs | 110 ++++++------------
.../Protocol/Types/ServerCapabilities.cs | 6 -
src/ModelContextProtocol/Server/McpServer.cs | 2 -
8 files changed, 50 insertions(+), 98 deletions(-)
diff --git a/samples/AuthorizationExample/Program.cs b/samples/AuthorizationExample/Program.cs
index 15ce6f65..35f46def 100644
--- a/samples/AuthorizationExample/Program.cs
+++ b/samples/AuthorizationExample/Program.cs
@@ -86,6 +86,8 @@ public static async Task Main(string[] args)
{
Console.WriteLine($"Inner Error: {ex.InnerException.Message}");
}
+ // Print the stack trace for debugging
+ Console.WriteLine($"Stack Trace:\n{ex.StackTrace}");
}
}
}
\ No newline at end of file
diff --git a/samples/AuthorizationServerExample/Program.cs b/samples/AuthorizationServerExample/Program.cs
index 97dfe309..ac375fff 100644
--- a/samples/AuthorizationServerExample/Program.cs
+++ b/samples/AuthorizationServerExample/Program.cs
@@ -35,11 +35,8 @@ public static async Task Main(string[] args)
// In a real application, this would verify the token with your identity provider
async Task ValidateToken(string token)
{
- // For demo purposes, we'll accept any token that starts with "valid_"
- // In production, you would validate the token with your identity provider
- var isValid = token.StartsWith("valid_", StringComparison.OrdinalIgnoreCase);
- Console.WriteLine($"Token validation result: {(isValid ? "Valid" : "Invalid")}");
- return isValid;
+ // For demo purposes, we'll accept any token.
+ return true;
}
// 3. Create an authorization provider with the PRM and token validator
diff --git a/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs b/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
index ce7f9b69..0c6ad374 100644
--- a/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
+++ b/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
@@ -32,13 +32,14 @@ public AuthorizationMiddleware(RequestDelegate next, ILogger
/// The HTTP context.
/// The MCP server options.
+ /// The authorization provider.
/// A representing the asynchronous operation.
- public async Task InvokeAsync(HttpContext context, IOptions serverOptions)
+ public async Task InvokeAsync(
+ HttpContext context,
+ IOptions serverOptions,
+ IServerAuthorizationProvider? authProvider = null)
{
// Check if authorization is configured
- var authCapability = serverOptions.Value.Capabilities?.Authorization;
- var authProvider = authCapability?.AuthorizationProvider;
-
if (authProvider == null)
{
// Authorization is not configured, proceed to the next middleware
diff --git a/src/ModelContextProtocol/Configuration/McpServerAuthorizationExtensions.cs b/src/ModelContextProtocol/Configuration/McpServerAuthorizationExtensions.cs
index ab29813e..7592b5e9 100644
--- a/src/ModelContextProtocol/Configuration/McpServerAuthorizationExtensions.cs
+++ b/src/ModelContextProtocol/Configuration/McpServerAuthorizationExtensions.cs
@@ -24,13 +24,12 @@ public static IMcpServerBuilder WithAuthorization(
Throw.IfNull(builder);
Throw.IfNull(authorizationProvider);
+ // Register the authorization provider in the DI container
+ builder.Services.AddSingleton(authorizationProvider);
+
builder.Services.Configure(options =>
{
options.Capabilities ??= new ServerCapabilities();
- options.Capabilities.Authorization = new AuthorizationCapability
- {
- AuthorizationProvider = authorizationProvider
- };
});
return builder;
diff --git a/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs b/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs
index 80edc6a2..326f82fb 100644
--- a/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs
@@ -1,9 +1,8 @@
-using System.Diagnostics;
-using System.Net;
-using System.Net.Http.Headers;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Logging.Abstractions;
using ModelContextProtocol.Utils;
+using System.Net;
+using System.Net.Http.Headers;
namespace ModelContextProtocol.Protocol.Auth;
diff --git a/src/ModelContextProtocol/Protocol/Transport/SseClientSessionTransport.cs b/src/ModelContextProtocol/Protocol/Transport/SseClientSessionTransport.cs
index 2f5ad8f3..aa341880 100644
--- a/src/ModelContextProtocol/Protocol/Transport/SseClientSessionTransport.cs
+++ b/src/ModelContextProtocol/Protocol/Transport/SseClientSessionTransport.cs
@@ -89,29 +89,12 @@ public override async Task SendMessageAsync(
if (_messageEndpoint == null)
throw new InvalidOperationException("Transport not connected");
- using var content = new StringContent(
- JsonSerializer.Serialize(message, McpJsonUtilities.JsonContext.Default.JsonRpcMessage),
- Encoding.UTF8,
- "application/json"
- );
-
string messageId = "(no id)";
if (message is JsonRpcMessageWithId messageWithId)
{
messageId = messageWithId.Id.ToString();
}
-
- using var httpRequestMessage = new HttpRequestMessage(HttpMethod.Post, _messageEndpoint)
- {
- Content = content,
- };
-
- // Add authorization headers if needed
- await _authorizationHandler.AuthenticateRequestAsync(httpRequestMessage).ConfigureAwait(false);
-
- // Copy additional headers
- CopyAdditionalHeaders(httpRequestMessage.Headers);
// Send the request, handling potential auth challenges
HttpResponseMessage? response = null;
@@ -120,37 +103,32 @@ public override async Task SendMessageAsync(
do
{
authRetry = false;
- response = await _httpClient.SendAsync(httpRequestMessage, cancellationToken).ConfigureAwait(false);
- // Handle 401 Unauthorized response
+ // Create a new request for each attempt
+ using var currentRequest = new HttpRequestMessage(HttpMethod.Post, _messageEndpoint);
+ currentRequest.Content = new StringContent(
+ JsonSerializer.Serialize(message, McpJsonUtilities.JsonContext.Default.JsonRpcMessage),
+ Encoding.UTF8,
+ "application/json"
+ );
+
+ // Add authorization headers if needed - the handler will only add headers if auth is required
+ await _authorizationHandler.AuthenticateRequestAsync(currentRequest).ConfigureAwait(false);
+
+ // Copy additional headers
+ CopyAdditionalHeaders(currentRequest.Headers);
+
+ // Dispose previous response before making a new request
+ response?.Dispose();
+
+ response = await _httpClient.SendAsync(currentRequest, cancellationToken).ConfigureAwait(false);
+
+ // Handle 401 Unauthorized response - this will only execute if the server requires auth
if (response.StatusCode == HttpStatusCode.Unauthorized)
{
// Try to handle the unauthorized response
authRetry = await _authorizationHandler.HandleUnauthorizedResponseAsync(
response, _messageEndpoint).ConfigureAwait(false);
-
- if (authRetry)
- {
- // Create a new request (we can't reuse the previous one)
- using var newRequest = new HttpRequestMessage(HttpMethod.Post, _messageEndpoint)
- {
- Content = new StringContent(
- JsonSerializer.Serialize(message, McpJsonUtilities.JsonContext.Default.JsonRpcMessage),
- Encoding.UTF8,
- "application/json"
- )
- };
-
- // Add authorization headers for the new request
- await _authorizationHandler.AuthenticateRequestAsync(newRequest).ConfigureAwait(false);
- CopyAdditionalHeaders(newRequest.Headers);
-
- // Dispose the previous response
- response.Dispose();
-
- // Send the new request
- response = await _httpClient.SendAsync(newRequest, cancellationToken).ConfigureAwait(false);
- }
}
} while (authRetry);
@@ -252,15 +230,6 @@ private async Task ReceiveMessagesAsync(CancellationToken cancellationToken)
{
try
{
- using var request = new HttpRequestMessage(HttpMethod.Get, _sseEndpoint);
- request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("text/event-stream"));
-
- // Add authorization headers if needed
- await _authorizationHandler.AuthenticateRequestAsync(request).ConfigureAwait(false);
-
- // Copy additional headers
- CopyAdditionalHeaders(request.Headers);
-
// Send the request, handling potential auth challenges
HttpResponseMessage? response = null;
bool authRetry = false;
@@ -268,39 +237,32 @@ private async Task ReceiveMessagesAsync(CancellationToken cancellationToken)
do
{
authRetry = false;
+
+ // Create a new request for each attempt
+ using var currentRequest = new HttpRequestMessage(HttpMethod.Get, _sseEndpoint);
+ currentRequest.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("text/event-stream"));
+
+ // Add authorization headers if needed - the handler will only add headers if auth is required
+ await _authorizationHandler.AuthenticateRequestAsync(currentRequest).ConfigureAwait(false);
+
+ // Copy additional headers
+ CopyAdditionalHeaders(currentRequest.Headers);
+
+ // Dispose previous response before making a new request
+ response?.Dispose();
+
response = await _httpClient.SendAsync(
- request,
+ currentRequest,
HttpCompletionOption.ResponseHeadersRead,
cancellationToken
).ConfigureAwait(false);
- // Handle 401 Unauthorized response
+ // Handle 401 Unauthorized response - this will only execute if the server requires auth
if (response.StatusCode == HttpStatusCode.Unauthorized)
{
// Try to handle the unauthorized response
authRetry = await _authorizationHandler.HandleUnauthorizedResponseAsync(
response, _sseEndpoint).ConfigureAwait(false);
-
- if (authRetry)
- {
- // Create a new request (we can't reuse the previous one)
- using var newRequest = new HttpRequestMessage(HttpMethod.Get, _sseEndpoint);
- newRequest.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("text/event-stream"));
-
- // Add authorization headers for the new request
- await _authorizationHandler.AuthenticateRequestAsync(newRequest).ConfigureAwait(false);
- CopyAdditionalHeaders(newRequest.Headers);
-
- // Dispose the previous response
- response.Dispose();
-
- // Send the new request
- response = await _httpClient.SendAsync(
- newRequest,
- HttpCompletionOption.ResponseHeadersRead,
- cancellationToken
- ).ConfigureAwait(false);
- }
}
} while (authRetry);
diff --git a/src/ModelContextProtocol/Protocol/Types/ServerCapabilities.cs b/src/ModelContextProtocol/Protocol/Types/ServerCapabilities.cs
index 8e524845..6406ea4d 100644
--- a/src/ModelContextProtocol/Protocol/Types/ServerCapabilities.cs
+++ b/src/ModelContextProtocol/Protocol/Types/ServerCapabilities.cs
@@ -35,12 +35,6 @@ public class ServerCapabilities
[JsonPropertyName("experimental")]
public Dictionary? Experimental { get; set; }
- ///
- /// Gets or sets a server's authorization capability, supporting OAuth 2.0 authorization flows.
- ///
- [JsonPropertyName("authorization")]
- public AuthorizationCapability? Authorization { get; set; }
-
///
/// Gets or sets a server's logging capability, supporting sending log messages to the client.
///
diff --git a/src/ModelContextProtocol/Server/McpServer.cs b/src/ModelContextProtocol/Server/McpServer.cs
index aeee62dd..7faad5c9 100644
--- a/src/ModelContextProtocol/Server/McpServer.cs
+++ b/src/ModelContextProtocol/Server/McpServer.cs
@@ -328,7 +328,6 @@ await originalListPromptsHandler(request, cancellationToken).ConfigureAwait(fals
ServerCapabilities = new()
{
Experimental = options.Capabilities?.Experimental,
- Authorization = options.Capabilities?.Authorization,
Logging = options.Capabilities?.Logging,
Tools = options.Capabilities?.Tools,
Resources = options.Capabilities?.Resources,
@@ -427,7 +426,6 @@ await originalListToolsHandler(request, cancellationToken).ConfigureAwait(false)
ServerCapabilities = new()
{
Experimental = options.Capabilities?.Experimental,
- Authorization = options.Capabilities?.Authorization,
Logging = options.Capabilities?.Logging,
Prompts = options.Capabilities?.Prompts,
Resources = options.Capabilities?.Resources,
From bf9f63eba402561449852410d4c8c05c288eb5b7 Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 24 Apr 2025 00:05:58 -0700
Subject: [PATCH 14/28] Cleanup of unused declarations
---
.../Protocol/Auth/AuthorizationContext.cs | 2 --
.../Protocol/Auth/AuthorizationOptions.cs | 3 --
.../Protocol/Auth/AuthorizationService.cs | 4 +--
.../Protocol/Auth/IAuthorizationHandler.cs | 2 --
.../Auth/IServerAuthorizationProvider.cs | 2 --
.../Auth/SimpleServerAuthorizationProvider.cs | 29 +++++++------------
6 files changed, 13 insertions(+), 29 deletions(-)
diff --git a/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs b/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
index c210fd9e..df4c8e59 100644
--- a/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
@@ -1,5 +1,3 @@
-using System.Diagnostics;
-
namespace ModelContextProtocol.Protocol.Auth;
///
diff --git a/src/ModelContextProtocol/Protocol/Auth/AuthorizationOptions.cs b/src/ModelContextProtocol/Protocol/Auth/AuthorizationOptions.cs
index 506309c5..232de02e 100644
--- a/src/ModelContextProtocol/Protocol/Auth/AuthorizationOptions.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/AuthorizationOptions.cs
@@ -1,6 +1,3 @@
-using System;
-using System.Collections.Generic;
-
namespace ModelContextProtocol.Protocol.Auth;
///
diff --git a/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs b/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
index a6bc5807..4ff7222d 100644
--- a/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
@@ -1,10 +1,10 @@
+using ModelContextProtocol.Utils;
+using ModelContextProtocol.Utils.Json;
using System.Net;
using System.Net.Http.Headers;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
-using ModelContextProtocol.Utils;
-using ModelContextProtocol.Utils.Json;
namespace ModelContextProtocol.Protocol.Auth;
diff --git a/src/ModelContextProtocol/Protocol/Auth/IAuthorizationHandler.cs b/src/ModelContextProtocol/Protocol/Auth/IAuthorizationHandler.cs
index 85f5a61d..ffa41acb 100644
--- a/src/ModelContextProtocol/Protocol/Auth/IAuthorizationHandler.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/IAuthorizationHandler.cs
@@ -1,5 +1,3 @@
-using System.Net;
-
namespace ModelContextProtocol.Protocol.Auth;
///
diff --git a/src/ModelContextProtocol/Protocol/Auth/IServerAuthorizationProvider.cs b/src/ModelContextProtocol/Protocol/Auth/IServerAuthorizationProvider.cs
index 3d34def9..4aee3f22 100644
--- a/src/ModelContextProtocol/Protocol/Auth/IServerAuthorizationProvider.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/IServerAuthorizationProvider.cs
@@ -1,5 +1,3 @@
-using System.Text.Json;
-
namespace ModelContextProtocol.Protocol.Auth;
///
diff --git a/src/ModelContextProtocol/Server/Auth/SimpleServerAuthorizationProvider.cs b/src/ModelContextProtocol/Server/Auth/SimpleServerAuthorizationProvider.cs
index f99fb154..fdd9b925 100644
--- a/src/ModelContextProtocol/Server/Auth/SimpleServerAuthorizationProvider.cs
+++ b/src/ModelContextProtocol/Server/Auth/SimpleServerAuthorizationProvider.cs
@@ -1,5 +1,4 @@
using ModelContextProtocol.Protocol.Auth;
-using System.Security.Claims;
namespace ModelContextProtocol.Server.Auth;
@@ -11,24 +10,18 @@ namespace ModelContextProtocol.Server.Auth;
/// it should be extended or replaced with a more robust implementation that integrates with your
/// authentication system (e.g., OAuth 2.0 server, identity provider, etc.)
///
-public class SimpleServerAuthorizationProvider : IServerAuthorizationProvider
+///
+/// Initializes a new instance of the class
+/// with the specified resource metadata and token validator.
+///
+/// The protected resource metadata.
+/// A function that validates access tokens. If not provided, a function that always returns true will be used.
+public class SimpleServerAuthorizationProvider(
+ ProtectedResourceMetadata resourceMetadata,
+ Func>? tokenValidator = null) : IServerAuthorizationProvider
{
- private readonly ProtectedResourceMetadata _resourceMetadata;
- private readonly Func> _tokenValidator;
-
- ///
- /// Initializes a new instance of the class
- /// with the specified resource metadata and token validator.
- ///
- /// The protected resource metadata.
- /// A function that validates access tokens. If not provided, a function that always returns true will be used.
- public SimpleServerAuthorizationProvider(
- ProtectedResourceMetadata resourceMetadata,
- Func>? tokenValidator = null)
- {
- _resourceMetadata = resourceMetadata ?? throw new ArgumentNullException(nameof(resourceMetadata));
- _tokenValidator = tokenValidator ?? (_ => Task.FromResult(true));
- }
+ private readonly ProtectedResourceMetadata _resourceMetadata = resourceMetadata ?? throw new ArgumentNullException(nameof(resourceMetadata));
+ private readonly Func> _tokenValidator = tokenValidator ?? (_ => Task.FromResult(true));
///
public ProtectedResourceMetadata GetProtectedResourceMetadata() => _resourceMetadata;
From 3fd7681b06f23de25092bcbd9400cc4707421935 Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Wed, 30 Apr 2025 23:50:03 -0700
Subject: [PATCH 15/28] Remove handler from transport definition
---
samples/AuthorizationExample/Program.cs | 6 +-
.../Auth/AuthorizationServerMetadata.cs | 2 +-
.../Protocol/Auth/AuthorizationService.cs | 163 +++++++++++++++++-
.../Auth/ClientRegistrationResponse.cs | 2 +-
.../Protocol/Auth/ResourceMetadata.cs | 2 +-
.../Protocol/Auth/TokenResponse.cs | 2 +-
.../Protocol/Transport/SseClientTransport.cs | 160 -----------------
.../Transport/SseClientTransportOptions.cs | 5 +-
8 files changed, 168 insertions(+), 174 deletions(-)
diff --git a/samples/AuthorizationExample/Program.cs b/samples/AuthorizationExample/Program.cs
index 35f46def..42b1c83c 100644
--- a/samples/AuthorizationExample/Program.cs
+++ b/samples/AuthorizationExample/Program.cs
@@ -36,10 +36,8 @@ public static async Task Main(string[] args)
RedirectUris = new[]
{
$"http://{hostname}:{port}{callbackPath}"
- },
-
- // Configure the authorize callback with the same hostname, port, and path
- AuthorizeCallback = SseClientTransport.CreateHttpListenerAuthorizeCallback(
+ }, // Configure the authorize callback with the same hostname, port, and path
+ AuthorizeCallback = AuthorizationService.CreateHttpListenerAuthorizeCallback(
openBrowser: async (url) =>
{
Console.WriteLine($"Opening browser to authorize at: {url}");
diff --git a/src/ModelContextProtocol/Protocol/Auth/AuthorizationServerMetadata.cs b/src/ModelContextProtocol/Protocol/Auth/AuthorizationServerMetadata.cs
index 9be69e67..56ce385f 100644
--- a/src/ModelContextProtocol/Protocol/Auth/AuthorizationServerMetadata.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/AuthorizationServerMetadata.cs
@@ -5,7 +5,7 @@ namespace ModelContextProtocol.Protocol.Auth;
///
/// Represents OAuth 2.0 authorization server metadata as defined in RFC 8414.
///
-internal class AuthorizationServerMetadata
+public class AuthorizationServerMetadata
{
///
/// Gets or sets the authorization endpoint URL.
diff --git a/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs b/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
index 4ff7222d..8db6028a 100644
--- a/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
@@ -11,7 +11,7 @@ namespace ModelContextProtocol.Protocol.Auth;
///
/// Provides OAuth 2.0 authorization services for MCP clients.
///
-internal class AuthorizationService
+public class AuthorizationService
{
private static readonly HttpClient s_httpClient = new()
{
@@ -448,9 +448,166 @@ private static Dictionary ParseAuthHeaderParameters(string param
break;
start = commaPos + 1;
- }
- }
+ } }
return result;
}
+
+ ///
+ /// Creates an HTTP listener callback for handling OAuth 2.0 authorization code flow.
+ ///
+ /// A function that opens a browser with the given URL.
+ /// The hostname to listen on. Defaults to "localhost".
+ /// The port to listen on. Defaults to 8888.
+ /// The redirect path for the HTTP listener. Defaults to "/callback".
+ ///
+ /// A function that takes and returns a task that resolves to a tuple containing
+ /// the redirect URI and the authorization code.
+ ///
+ public static Func> CreateHttpListenerAuthorizeCallback(
+ Func openBrowser,
+ string hostname = "localhost",
+ int listenPort = 8888,
+ string redirectPath = "/callback")
+ {
+ return async (ClientMetadata clientMetadata) =>
+ {
+ string redirectUri = $"http://{hostname}:{listenPort}{redirectPath}";
+
+ foreach (var uri in clientMetadata.RedirectUris)
+ {
+ if (uri.StartsWith($"http://{hostname}", StringComparison.OrdinalIgnoreCase) &&
+ Uri.TryCreate(uri, UriKind.Absolute, out var parsedUri))
+ {
+ redirectUri = uri;
+ listenPort = parsedUri.IsDefaultPort ? 80 : parsedUri.Port;
+ redirectPath = parsedUri.AbsolutePath;
+ break;
+ }
+ }
+
+ var authCodeTcs = new TaskCompletionSource();
+ // Ensure the path has a trailing slash for the HttpListener prefix
+ string listenerPrefix = $"http://{hostname}:{listenPort}{redirectPath}";
+ if (!listenerPrefix.EndsWith("/"))
+ {
+ listenerPrefix += "/";
+ }
+
+ using var listener = new HttpListener();
+ listener.Prefixes.Add(listenerPrefix);
+
+ // Start the listener BEFORE opening the browser
+ try
+ {
+ listener.Start();
+ }
+ catch (HttpListenerException ex)
+ {
+ throw new McpException($"Failed to start HTTP listener on {listenerPrefix}: {ex.Message}", McpErrorCode.InvalidRequest);
+ }
+
+ // Create a cancellation token source with a timeout
+ using var cts = new CancellationTokenSource(TimeSpan.FromMinutes(5));
+
+ _ = Task.Run(async () =>
+ {
+ try
+ {
+ // GetContextAsync doesn't accept a cancellation token, so we need to handle cancellation manually
+ var contextTask = listener.GetContextAsync();
+ var completedTask = await Task.WhenAny(contextTask, Task.Delay(Timeout.Infinite, cts.Token));
+
+ if (completedTask == contextTask)
+ {
+ var context = await contextTask;
+ var request = context.Request;
+ var response = context.Response;
+
+ string? code = request.QueryString["code"];
+ string? error = request.QueryString["error"];
+ string html;
+ string? resultCode = null;
+
+ if (!string.IsNullOrEmpty(error))
+ {
+ html = $"Authorization Failed
Error: {WebUtility.HtmlEncode(error)}
";
+ }
+ else if (string.IsNullOrEmpty(code))
+ {
+ html = "Authorization Failed
No authorization code received.
";
+ }
+ else
+ {
+ html = "Authorization Successful
You may now close this window.
";
+ resultCode = code;
+ }
+
+ try
+ {
+ // Send response to browser
+ byte[] buffer = Encoding.UTF8.GetBytes(html);
+ response.ContentType = "text/html";
+ response.ContentLength64 = buffer.Length;
+ response.OutputStream.Write(buffer, 0, buffer.Length);
+
+ // IMPORTANT: Explicitly close the response to ensure it's fully sent
+ response.Close();
+
+ // Now that we've finished processing the browser response,
+ // we can safely signal completion or failure with the auth code
+ if (resultCode != null)
+ {
+ authCodeTcs.TrySetResult(resultCode);
+ }
+ else if (!string.IsNullOrEmpty(error))
+ {
+ authCodeTcs.TrySetException(new McpException($"Authorization failed: {error}", McpErrorCode.InvalidRequest));
+ }
+ else
+ {
+ authCodeTcs.TrySetException(new McpException("No authorization code received", McpErrorCode.InvalidRequest));
+ }
+ }
+ catch (Exception ex)
+ {
+ authCodeTcs.TrySetException(new McpException($"Error processing browser response: {ex.Message}", McpErrorCode.InvalidRequest));
+ }
+ }
+ }
+ catch (Exception ex)
+ {
+ authCodeTcs.TrySetException(ex);
+ }
+ });
+
+ // Now open the browser AFTER the listener is started
+ if (!string.IsNullOrEmpty(clientMetadata.ClientUri))
+ {
+ await openBrowser(clientMetadata.ClientUri!);
+ }
+ else
+ {
+ // Stop the listener before throwing
+ listener.Stop();
+ throw new McpException("Client URI is missing in metadata.", McpErrorCode.InvalidRequest);
+ }
+
+ try
+ {
+ // Use a timeout to avoid hanging indefinitely
+ string authCode = await authCodeTcs.Task.WaitAsync(cts.Token);
+ return (redirectUri, authCode);
+ }
+ catch (OperationCanceledException)
+ {
+ throw new McpException("Authorization timed out after 5 minutes.", McpErrorCode.InvalidRequest);
+ }
+ finally
+ {
+ // Ensure the listener is stopped when we're done
+ listener.Stop();
+ }
+ };
+ }
}
\ No newline at end of file
diff --git a/src/ModelContextProtocol/Protocol/Auth/ClientRegistrationResponse.cs b/src/ModelContextProtocol/Protocol/Auth/ClientRegistrationResponse.cs
index 06cef8b5..d7042b3a 100644
--- a/src/ModelContextProtocol/Protocol/Auth/ClientRegistrationResponse.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/ClientRegistrationResponse.cs
@@ -5,7 +5,7 @@ namespace ModelContextProtocol.Protocol.Auth;
///
/// Represents the OAuth 2.0 client registration response as defined in RFC 7591.
///
-internal class ClientRegistrationResponse
+public class ClientRegistrationResponse
{
///
/// Gets or sets the OAuth 2.0 client identifier string.
diff --git a/src/ModelContextProtocol/Protocol/Auth/ResourceMetadata.cs b/src/ModelContextProtocol/Protocol/Auth/ResourceMetadata.cs
index bf6613a1..a57456c3 100644
--- a/src/ModelContextProtocol/Protocol/Auth/ResourceMetadata.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/ResourceMetadata.cs
@@ -5,7 +5,7 @@ namespace ModelContextProtocol.Protocol.Auth;
///
/// Represents the resource metadata from the WWW-Authenticate header in a 401 Unauthorized response.
///
-internal class ResourceMetadata
+public class ResourceMetadata
{
///
/// Gets or sets the resource identifier URI.
diff --git a/src/ModelContextProtocol/Protocol/Auth/TokenResponse.cs b/src/ModelContextProtocol/Protocol/Auth/TokenResponse.cs
index 2c5faefe..d6b33489 100644
--- a/src/ModelContextProtocol/Protocol/Auth/TokenResponse.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/TokenResponse.cs
@@ -5,7 +5,7 @@ namespace ModelContextProtocol.Protocol.Auth;
///
/// Represents the OAuth 2.0 token response as defined in RFC 6749.
///
-internal class TokenResponse
+public class TokenResponse
{
///
/// Gets or sets the access token issued by the authorization server.
diff --git a/src/ModelContextProtocol/Protocol/Transport/SseClientTransport.cs b/src/ModelContextProtocol/Protocol/Transport/SseClientTransport.cs
index 8e83acad..56889724 100644
--- a/src/ModelContextProtocol/Protocol/Transport/SseClientTransport.cs
+++ b/src/ModelContextProtocol/Protocol/Transport/SseClientTransport.cs
@@ -1,8 +1,6 @@
using Microsoft.Extensions.Logging;
using ModelContextProtocol.Protocol.Auth;
using ModelContextProtocol.Utils;
-using System.Net;
-using System.Text;
namespace ModelContextProtocol.Protocol.Transport;
@@ -62,164 +60,6 @@ public SseClientTransport(SseClientTransportOptions transportOptions, HttpClient
///
public string Name { get; }
- ///
- /// Creates a callback function for handling OAuth 2.0 authorization flows using an HTTP listener.
- ///
- /// A function to open the browser to the authorization URL.
- /// The hostname for the HTTP listener. Defaults to "localhost".
- /// The port for the HTTP listener. Defaults to 8888.
- /// The redirect path for the HTTP listener. Defaults to "/callback".
- ///
- /// A function that takes and returns a task that resolves to a tuple containing
- /// the redirect URI and the authorization code.
- ///
- public static Func> CreateHttpListenerAuthorizeCallback(
- Func openBrowser,
- string hostname = "localhost",
- int listenPort = 8888,
- string redirectPath = "/callback")
- {
- return async (ClientMetadata clientMetadata) =>
- {
- string redirectUri = $"http://{hostname}:{listenPort}{redirectPath}";
-
- foreach (var uri in clientMetadata.RedirectUris)
- {
- if (uri.StartsWith($"http://{hostname}", StringComparison.OrdinalIgnoreCase) &&
- Uri.TryCreate(uri, UriKind.Absolute, out var parsedUri))
- {
- redirectUri = uri;
- listenPort = parsedUri.IsDefaultPort ? 80 : parsedUri.Port;
- redirectPath = parsedUri.AbsolutePath;
- break;
- }
- }
-
- var authCodeTcs = new TaskCompletionSource();
- // Ensure the path has a trailing slash for the HttpListener prefix
- string listenerPrefix = $"http://{hostname}:{listenPort}{redirectPath}";
- if (!listenerPrefix.EndsWith("/"))
- {
- listenerPrefix += "/";
- }
-
- using var listener = new HttpListener();
- listener.Prefixes.Add(listenerPrefix);
-
- // Start the listener BEFORE opening the browser
- try
- {
- listener.Start();
- }
- catch (HttpListenerException ex)
- {
- throw new McpException($"Failed to start HTTP listener on {listenerPrefix}: {ex.Message}", McpErrorCode.InvalidRequest);
- }
-
- // Create a cancellation token source with a timeout
- using var cts = new CancellationTokenSource(TimeSpan.FromMinutes(5));
-
- _ = Task.Run(async () =>
- {
- try
- {
- // GetContextAsync doesn't accept a cancellation token, so we need to handle cancellation manually
- var contextTask = listener.GetContextAsync();
- var completedTask = await Task.WhenAny(contextTask, Task.Delay(Timeout.Infinite, cts.Token));
-
- if (completedTask == contextTask)
- {
- var context = await contextTask;
- var request = context.Request;
- var response = context.Response;
-
- string? code = request.QueryString["code"];
- string? error = request.QueryString["error"];
- string html;
- string? resultCode = null;
-
- if (!string.IsNullOrEmpty(error))
- {
- html = $"Authorization Failed
Error: {WebUtility.HtmlEncode(error)}
";
- }
- else if (string.IsNullOrEmpty(code))
- {
- html = "Authorization Failed
No authorization code received.
";
- }
- else
- {
- html = "Authorization Successful
You may now close this window.
";
- resultCode = code;
- }
-
- try
- {
- // Send response to browser
- byte[] buffer = Encoding.UTF8.GetBytes(html);
- response.ContentType = "text/html";
- response.ContentLength64 = buffer.Length;
- response.OutputStream.Write(buffer, 0, buffer.Length);
-
- // IMPORTANT: Explicitly close the response to ensure it's fully sent
- response.Close();
-
- // Now that we've finished processing the browser response,
- // we can safely signal completion or failure with the auth code
- if (resultCode != null)
- {
- authCodeTcs.TrySetResult(resultCode);
- }
- else if (!string.IsNullOrEmpty(error))
- {
- authCodeTcs.TrySetException(new McpException($"Authorization failed: {error}", McpErrorCode.InvalidRequest));
- }
- else
- {
- authCodeTcs.TrySetException(new McpException("No authorization code received", McpErrorCode.InvalidRequest));
- }
- }
- catch (Exception ex)
- {
- authCodeTcs.TrySetException(new McpException($"Error processing browser response: {ex.Message}", McpErrorCode.InvalidRequest));
- }
- }
- }
- catch (Exception ex)
- {
- authCodeTcs.TrySetException(ex);
- }
- });
-
- // Now open the browser AFTER the listener is started
- if (!string.IsNullOrEmpty(clientMetadata.ClientUri))
- {
- await openBrowser(clientMetadata.ClientUri!);
- }
- else
- {
- // Stop the listener before throwing
- listener.Stop();
- throw new McpException("Client URI is missing in metadata.", McpErrorCode.InvalidRequest);
- }
-
- try
- {
- // Use a timeout to avoid hanging indefinitely
- string authCode = await authCodeTcs.Task.WaitAsync(cts.Token);
- return (redirectUri, authCode);
- }
- catch (OperationCanceledException)
- {
- throw new McpException("Authorization timed out after 5 minutes.", McpErrorCode.InvalidRequest);
- }
- finally
- {
- // Ensure the listener is stopped when we're done
- listener.Stop();
- }
- };
- }
-
///
public async Task ConnectAsync(CancellationToken cancellationToken = default)
{
diff --git a/src/ModelContextProtocol/Protocol/Transport/SseClientTransportOptions.cs b/src/ModelContextProtocol/Protocol/Transport/SseClientTransportOptions.cs
index cb1797b3..e430b907 100644
--- a/src/ModelContextProtocol/Protocol/Transport/SseClientTransportOptions.cs
+++ b/src/ModelContextProtocol/Protocol/Transport/SseClientTransportOptions.cs
@@ -73,14 +73,13 @@ public required Uri Endpoint
/// Example:
///
/// var transportOptions = new SseClientTransportOptions
- /// {
- /// Endpoint = new Uri("http://localhost:7071/sse"),
+ /// { /// Endpoint = new Uri("http://localhost:7071/sse"),
/// AuthorizationOptions = new McpAuthorizationOptions
/// {
/// ClientId = "my-client-id",
/// ClientSecret = "my-client-secret",
/// RedirectUris = new[] { "http://localhost:8888/callback" },
- /// AuthorizeCallback = SseClientTransport.CreateHttpListenerAuthorizeCallback(
+ /// AuthorizeCallback = AuthorizationService.CreateHttpListenerAuthorizeCallback(
/// openBrowser: url => Process.Start(new ProcessStartInfo(url) { UseShellExecute = true })
/// )
/// }
From 9bf4ea342bffa5da5b5b6e36b8c3230d3bc010c5 Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 00:08:31 -0700
Subject: [PATCH 16/28] Amend middleware logic
---
.../AuthorizationMiddleware.cs | 41 ++--------
.../HttpMcpServerBuilderExtensions.cs | 3 +-
.../McpAuthorizationFilter.cs | 79 +++++++++++++++++++
.../McpAuthorizationFilterFactory.cs | 53 +++++++++++++
.../McpEndpointRouteBuilderExtensions.cs | 38 ++++++++-
.../ProtectedResourceMetadataHandler.cs | 44 +++++++++++
6 files changed, 220 insertions(+), 38 deletions(-)
create mode 100644 src/ModelContextProtocol.AspNetCore/McpAuthorizationFilter.cs
create mode 100644 src/ModelContextProtocol.AspNetCore/McpAuthorizationFilterFactory.cs
create mode 100644 src/ModelContextProtocol.AspNetCore/ProtectedResourceMetadataHandler.cs
diff --git a/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs b/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
index 0c6ad374..d11bdf11 100644
--- a/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
+++ b/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
@@ -47,8 +47,9 @@ public async Task InvokeAsync(
return;
}
- // Handle the PRM document endpoint
- if (context.Request.Path.StartsWithSegments("/.well-known/oauth-protected-resource"))
+ // Handle the PRM document endpoint if not handled by the endpoint
+ if (context.Request.Path.StartsWithSegments("/.well-known/oauth-protected-resource") &&
+ context.GetEndpoint() == null)
{
_logger.LogDebug("Serving Protected Resource Metadata document");
context.Response.ContentType = "application/json";
@@ -59,40 +60,8 @@ await JsonSerializer.SerializeAsync(
return;
}
- // Serve SSE and message endpoints with authorization
- if (context.Request.Path.StartsWithSegments("/sse") ||
- (context.Request.Path.Value?.EndsWith("/message") == true))
- {
- // Check if the Authorization header is present
- if (!context.Request.Headers.TryGetValue("Authorization", out var authHeader) || string.IsNullOrEmpty(authHeader))
- {
- // No Authorization header present, return 401 Unauthorized
- var prm = authProvider.GetProtectedResourceMetadata();
- var prmUrl = GetPrmUrl(context, prm.Resource);
-
- _logger.LogDebug("Authorization required, returning 401 Unauthorized with WWW-Authenticate header");
- context.Response.StatusCode = StatusCodes.Status401Unauthorized;
- context.Response.Headers.Append("WWW-Authenticate", $"Bearer resource_metadata=\"{prmUrl}\"");
- return;
- }
-
- // Validate the token - ensuring authHeader is a non-null string
- string authHeaderValue = authHeader.ToString();
- bool isValid = await authProvider.ValidateTokenAsync(authHeaderValue);
- if (!isValid)
- {
- // Invalid token, return 401 Unauthorized
- var prm = authProvider.GetProtectedResourceMetadata();
- var prmUrl = GetPrmUrl(context, prm.Resource);
-
- _logger.LogDebug("Invalid authorization token, returning 401 Unauthorized");
- context.Response.StatusCode = StatusCodes.Status401Unauthorized;
- context.Response.Headers.Append("WWW-Authenticate", $"Bearer resource_metadata=\"{prmUrl}\"");
- return;
- }
- }
-
- // Token is valid or endpoint doesn't require authentication, proceed to the next middleware
+ // Proceed to the next middleware - authorization for SSE and message endpoints
+ // is now handled by endpoint filters
await _next(context);
}
diff --git a/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs b/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs
index c9a5ba87..907109e6 100644
--- a/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs
+++ b/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs
@@ -18,12 +18,13 @@ public static class HttpMcpServerBuilderExtensions
/// Configures options for the Streamable HTTP transport. This allows configuring per-session
/// and running logic before and after a session.
/// The builder provided in .
- /// is .
+ /// is .
public static IMcpServerBuilder WithHttpTransport(this IMcpServerBuilder builder, Action? configureOptions = null)
{
ArgumentNullException.ThrowIfNull(builder);
builder.Services.TryAddSingleton();
builder.Services.TryAddSingleton();
+ builder.Services.TryAddSingleton();
builder.Services.AddHostedService();
if (configureOptions is not null)
diff --git a/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilter.cs b/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilter.cs
new file mode 100644
index 00000000..be5f0a72
--- /dev/null
+++ b/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilter.cs
@@ -0,0 +1,79 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using ModelContextProtocol.Protocol.Auth;
+
+namespace ModelContextProtocol.AspNetCore;
+
+///
+/// An endpoint filter that handles authorization for MCP endpoints.
+///
+internal class McpAuthorizationFilter : IEndpointFilter
+{
+ private readonly ILogger _logger;
+ private readonly IServerAuthorizationProvider _authProvider;
+
+ ///
+ /// Initializes a new instance of the class.
+ ///
+ /// The logger.
+ /// The authorization provider.
+ public McpAuthorizationFilter(
+ ILogger logger,
+ IServerAuthorizationProvider authProvider)
+ {
+ _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+ _authProvider = authProvider ?? throw new ArgumentNullException(nameof(authProvider));
+ }
+
+ ///
+ public async ValueTask InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
+ {
+ var httpContext = context.HttpContext;
+
+ // Check if the Authorization header is present
+ if (!httpContext.Request.Headers.TryGetValue("Authorization", out var authHeader) || string.IsNullOrEmpty(authHeader))
+ {
+ // No Authorization header present, return 401 Unauthorized
+ var prm = _authProvider.GetProtectedResourceMetadata();
+ var prmUrl = GetPrmUrl(httpContext, prm.Resource);
+
+ _logger.LogDebug("Authorization required, returning 401 Unauthorized with WWW-Authenticate header");
+ httpContext.Response.StatusCode = StatusCodes.Status401Unauthorized;
+ httpContext.Response.Headers.Append("WWW-Authenticate", $"Bearer resource_metadata=\"{prmUrl}\"");
+ return Results.Empty;
+ }
+
+ // Validate the token - ensuring authHeader is a non-null string
+ string authHeaderValue = authHeader.ToString();
+ bool isValid = await _authProvider.ValidateTokenAsync(authHeaderValue);
+ if (!isValid)
+ {
+ // Invalid token, return 401 Unauthorized
+ var prm = _authProvider.GetProtectedResourceMetadata();
+ var prmUrl = GetPrmUrl(httpContext, prm.Resource);
+
+ _logger.LogDebug("Invalid authorization token, returning 401 Unauthorized");
+ httpContext.Response.StatusCode = StatusCodes.Status401Unauthorized;
+ httpContext.Response.Headers.Append("WWW-Authenticate", $"Bearer resource_metadata=\"{prmUrl}\"");
+ return Results.Empty;
+ }
+
+ // Token is valid, proceed to the next filter
+ return await next(context);
+ }
+
+ private static string GetPrmUrl(HttpContext context, string resourceUri)
+ {
+ // Use the actual resource URI from PRM if it's an absolute URL, otherwise build the URL
+ if (Uri.TryCreate(resourceUri, UriKind.Absolute, out _))
+ {
+ return $"{resourceUri.TrimEnd('/')}/.well-known/oauth-protected-resource";
+ }
+
+ // Build the URL from the current request
+ var request = context.Request;
+ var scheme = request.Scheme;
+ var host = request.Host.Value;
+ return $"{scheme}://{host}/.well-known/oauth-protected-resource";
+ }
+}
diff --git a/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilterFactory.cs b/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilterFactory.cs
new file mode 100644
index 00000000..02890f40
--- /dev/null
+++ b/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilterFactory.cs
@@ -0,0 +1,53 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using ModelContextProtocol.Protocol.Auth;
+
+namespace ModelContextProtocol.AspNetCore;
+
+///
+/// Factory for creating instances.
+///
+internal class McpAuthorizationFilterFactory
+{
+ private readonly IServiceProvider _serviceProvider;
+
+ ///
+ /// Initializes a new instance of the class.
+ ///
+ /// The service provider.
+ public McpAuthorizationFilterFactory(IServiceProvider serviceProvider)
+ {
+ _serviceProvider = serviceProvider ?? throw new ArgumentNullException(nameof(serviceProvider));
+ }
+
+ ///
+ /// Creates an endpoint filter delegate for authorization.
+ ///
+ /// The endpoint filter factory context.
+ /// The next filter delegate in the pipeline.
+ /// The filter delegate.
+ public EndpointFilterDelegate Create(EndpointFilterFactoryContext context, EndpointFilterDelegate next)
+ {
+ // This factory creates a filter that checks if the current endpoint is an SSE or message endpoint
+ // and applies authorization only to those endpoints
+ return async invocationContext =>
+ {
+ var httpContext = invocationContext.HttpContext;
+ var path = httpContext.Request.Path.Value?.TrimEnd('/');
+
+ // Only apply authorization to /sse and /message endpoints
+ if (path != null && (path.EndsWith("/sse") || path.EndsWith("/message")))
+ {
+ var authProvider = _serviceProvider.GetRequiredService();
+ var logger = _serviceProvider.GetRequiredService>();
+
+ var filter = new McpAuthorizationFilter(logger, authProvider);
+ return await filter.InvokeAsync(invocationContext, next);
+ }
+
+ // For all other endpoints, just invoke the next filter
+ return await next(invocationContext);
+ };
+ }
+}
diff --git a/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs b/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs
index 0eefa52f..56ae7b82 100644
--- a/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs
+++ b/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs
@@ -2,7 +2,9 @@
using Microsoft.AspNetCore.Http.Metadata;
using Microsoft.AspNetCore.Routing;
using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
using ModelContextProtocol.AspNetCore;
+using ModelContextProtocol.Protocol.Auth;
using ModelContextProtocol.Protocol.Messages;
using System.Diagnostics.CodeAnalysis;
@@ -20,12 +22,36 @@ public static class McpEndpointRouteBuilderExtensions
///
/// The web application to attach MCP HTTP endpoints.
/// The route pattern prefix to map to.
- /// Returns a builder for configuring additional endpoint conventions like authorization policies.
+ /// Returns a builder for configuring additional endpoint conventions like authorization policies.
public static IEndpointConventionBuilder MapMcp(this IEndpointRouteBuilder endpoints, [StringSyntax("Route")] string pattern = "")
{
var streamableHttpHandler = endpoints.ServiceProvider.GetService() ??
throw new InvalidOperationException("You must call WithHttpTransport(). Unable to find required services. Call builder.Services.AddMcpServer().WithHttpTransport() in application startup code.");
+ // Map the protected resource metadata endpoint if authorization is configured
+ var authProvider = endpoints.ServiceProvider.GetService();
+ if (authProvider != null)
+ {
+ // Create and register the ProtectedResourceMetadataHandler if it's not already registered
+ ProtectedResourceMetadataHandler? prmHandler = null;
+ try
+ {
+ prmHandler = endpoints.ServiceProvider.GetService();
+ }
+ catch
+ {
+ // Ignore - we'll create it below
+ }
+
+ if (prmHandler == null)
+ {
+ var logger = endpoints.ServiceProvider.GetRequiredService>();
+ prmHandler = new ProtectedResourceMetadataHandler(logger, authProvider);
+ }
+
+ endpoints.MapGet("/.well-known/oauth-protected-resource", prmHandler.HandleAsync);
+ }
+
var mcpGroup = endpoints.MapGroup(pattern);
var streamableHttpGroup = mcpGroup.MapGroup("")
.WithDisplayName(b => $"MCP Streamable HTTP | {b.DisplayName}")
@@ -44,6 +70,16 @@ public static IEndpointConventionBuilder MapMcp(this IEndpointRouteBuilder endpo
var sseGroup = mcpGroup.MapGroup("")
.WithDisplayName(b => $"MCP HTTP with SSE | {b.DisplayName}");
+ // Apply authorization filter to SSE endpoints if authorization is configured
+ if (authProvider != null)
+ {
+ // Create the filter factory
+ var filterFactory = endpoints.ServiceProvider.GetRequiredService();
+
+ // Apply filter to SSE and message endpoints
+ sseGroup.AddEndpointFilterFactory(filterFactory.Create);
+ }
+
sseGroup.MapGet("/sse", sseHandler.HandleSseRequestAsync)
.WithMetadata(new ProducesResponseTypeMetadata(StatusCodes.Status200OK, contentTypes: ["text/event-stream"]));
sseGroup.MapPost("/message", sseHandler.HandleMessageRequestAsync)
diff --git a/src/ModelContextProtocol.AspNetCore/ProtectedResourceMetadataHandler.cs b/src/ModelContextProtocol.AspNetCore/ProtectedResourceMetadataHandler.cs
new file mode 100644
index 00000000..ae9c87d9
--- /dev/null
+++ b/src/ModelContextProtocol.AspNetCore/ProtectedResourceMetadataHandler.cs
@@ -0,0 +1,44 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using ModelContextProtocol.Protocol.Auth;
+using ModelContextProtocol.Utils.Json;
+using System.Text.Json;
+
+namespace ModelContextProtocol.AspNetCore;
+
+///
+/// Handler for the Protected Resource Metadata document endpoint.
+///
+internal class ProtectedResourceMetadataHandler
+{
+ private readonly ILogger _logger;
+ private readonly IServerAuthorizationProvider _authProvider;
+
+ ///
+ /// Initializes a new instance of the class.
+ ///
+ /// The logger.
+ /// The authorization provider.
+ public ProtectedResourceMetadataHandler(
+ ILogger logger,
+ IServerAuthorizationProvider authProvider)
+ {
+ _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+ _authProvider = authProvider ?? throw new ArgumentNullException(nameof(authProvider));
+ }
+
+ ///
+ /// Handles the request for the Protected Resource Metadata document.
+ ///
+ /// The HTTP context.
+ /// A task that represents the asynchronous operation.
+ public async Task HandleAsync(HttpContext context)
+ {
+ _logger.LogDebug("Serving Protected Resource Metadata document");
+ context.Response.ContentType = "application/json";
+ await JsonSerializer.SerializeAsync(
+ context.Response.Body,
+ _authProvider.GetProtectedResourceMetadata(),
+ McpJsonUtilities.DefaultOptions.GetTypeInfo(typeof(ProtectedResourceMetadata)));
+ }
+}
From fd60a1c159e6d14ab1ebeb70a6c276f1dd01ad2a Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 12:38:53 -0700
Subject: [PATCH 17/28] Trim implementation
---
.../HttpMcpServerBuilderExtensions.cs | 1 -
.../McpAuthorizationFilterFactory.cs | 53 -----------
.../McpEndpointAuthorizationExtensions.cs | 64 ++++++++++++++
.../McpEndpointAuthorizationFilter.cs | 84 ++++++++++++++++++
.../McpEndpointRouteBuilderExtensions.cs | 27 +++---
.../Transport/SseClientSessionTransport.cs | 88 +++++--------------
6 files changed, 182 insertions(+), 135 deletions(-)
delete mode 100644 src/ModelContextProtocol.AspNetCore/McpAuthorizationFilterFactory.cs
create mode 100644 src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationExtensions.cs
create mode 100644 src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
diff --git a/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs b/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs
index 9f329b6f..32fc5341 100644
--- a/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs
+++ b/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs
@@ -25,7 +25,6 @@ public static IMcpServerBuilder WithHttpTransport(this IMcpServerBuilder builder
builder.Services.TryAddSingleton();
builder.Services.TryAddSingleton();
- builder.Services.TryAddSingleton();
builder.Services.AddHostedService();
if (configureOptions is not null)
diff --git a/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilterFactory.cs b/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilterFactory.cs
deleted file mode 100644
index 02890f40..00000000
--- a/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilterFactory.cs
+++ /dev/null
@@ -1,53 +0,0 @@
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Logging;
-using ModelContextProtocol.Protocol.Auth;
-
-namespace ModelContextProtocol.AspNetCore;
-
-///
-/// Factory for creating instances.
-///
-internal class McpAuthorizationFilterFactory
-{
- private readonly IServiceProvider _serviceProvider;
-
- ///
- /// Initializes a new instance of the class.
- ///
- /// The service provider.
- public McpAuthorizationFilterFactory(IServiceProvider serviceProvider)
- {
- _serviceProvider = serviceProvider ?? throw new ArgumentNullException(nameof(serviceProvider));
- }
-
- ///
- /// Creates an endpoint filter delegate for authorization.
- ///
- /// The endpoint filter factory context.
- /// The next filter delegate in the pipeline.
- /// The filter delegate.
- public EndpointFilterDelegate Create(EndpointFilterFactoryContext context, EndpointFilterDelegate next)
- {
- // This factory creates a filter that checks if the current endpoint is an SSE or message endpoint
- // and applies authorization only to those endpoints
- return async invocationContext =>
- {
- var httpContext = invocationContext.HttpContext;
- var path = httpContext.Request.Path.Value?.TrimEnd('/');
-
- // Only apply authorization to /sse and /message endpoints
- if (path != null && (path.EndsWith("/sse") || path.EndsWith("/message")))
- {
- var authProvider = _serviceProvider.GetRequiredService();
- var logger = _serviceProvider.GetRequiredService>();
-
- var filter = new McpAuthorizationFilter(logger, authProvider);
- return await filter.InvokeAsync(invocationContext, next);
- }
-
- // For all other endpoints, just invoke the next filter
- return await next(invocationContext);
- };
- }
-}
diff --git a/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationExtensions.cs b/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationExtensions.cs
new file mode 100644
index 00000000..5a8090fa
--- /dev/null
+++ b/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationExtensions.cs
@@ -0,0 +1,64 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using ModelContextProtocol.Protocol.Auth;
+
+namespace ModelContextProtocol.AspNetCore;
+
+///
+/// Provides extension methods for adding MCP authorization to endpoints.
+///
+public static class McpEndpointAuthorizationExtensions
+{
+ ///
+ /// Adds MCP authorization filter to an endpoint.
+ ///
+ /// The endpoint convention builder.
+ /// The authorization provider.
+ /// The service provider.
+ /// The builder for chaining.
+ public static IEndpointConventionBuilder AddMcpAuthorization(
+ this IEndpointConventionBuilder builder,
+ IServerAuthorizationProvider authProvider,
+ IServiceProvider serviceProvider)
+ {
+ if (authProvider == null)
+ {
+ return builder; // No authorization needed
+ }
+
+ var logger = serviceProvider.GetRequiredService>();
+ var filter = new McpEndpointAuthorizationFilter(logger, authProvider);
+
+ return builder.AddEndpointFilter(filter);
+ }
+
+ ///
+ /// Adds MCP authorization filter to multiple endpoints.
+ ///
+ /// The collection of endpoint convention builders.
+ /// The authorization provider.
+ /// The service provider.
+ /// The original collection for chaining.
+ public static IEnumerable AddMcpAuthorization(
+ this IEnumerable endpoints,
+ IServerAuthorizationProvider authProvider,
+ IServiceProvider serviceProvider)
+ {
+ if (authProvider == null)
+ {
+ return endpoints; // No authorization needed
+ }
+
+ var logger = serviceProvider.GetRequiredService>();
+ var filter = new McpEndpointAuthorizationFilter(logger, authProvider);
+
+ foreach (var endpoint in endpoints)
+ {
+ endpoint.AddEndpointFilter(filter);
+ }
+
+ return endpoints;
+ }
+}
diff --git a/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs b/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
new file mode 100644
index 00000000..f0ebe5df
--- /dev/null
+++ b/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
@@ -0,0 +1,84 @@
+// filepath: c:\Users\ddelimarsky\source\csharp-sdk\src\ModelContextProtocol.AspNetCore\McpEndpointAuthorizationFilter.cs
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using ModelContextProtocol.Protocol.Auth;
+
+namespace ModelContextProtocol.AspNetCore;
+
+///
+/// An endpoint filter that handles authorization for MCP endpoints using the standard ASP.NET Core endpoint filter pattern.
+///
+internal class McpEndpointAuthorizationFilter : IEndpointFilter
+{
+ private readonly ILogger _logger;
+ private readonly IServerAuthorizationProvider _authProvider;
+
+ ///
+ /// Initializes a new instance of the class.
+ ///
+ /// The logger.
+ /// The authorization provider.
+ public McpEndpointAuthorizationFilter(ILogger logger, IServerAuthorizationProvider authProvider)
+ {
+ _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+ _authProvider = authProvider ?? throw new ArgumentNullException(nameof(authProvider));
+ }
+
+ ///
+ public async ValueTask InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
+ {
+ var httpContext = context.HttpContext;
+
+ // Check if the Authorization header is present
+ if (!httpContext.Request.Headers.TryGetValue("Authorization", out var authHeader) || string.IsNullOrEmpty(authHeader))
+ {
+ // No Authorization header present, return 401 Unauthorized
+ var prm = _authProvider.GetProtectedResourceMetadata();
+ var prmUrl = GetPrmUrl(httpContext, prm.Resource);
+
+ _logger.LogDebug("Authorization required, returning 401 Unauthorized with WWW-Authenticate header");
+ httpContext.Response.StatusCode = StatusCodes.Status401Unauthorized;
+ httpContext.Response.Headers.Append("WWW-Authenticate", $"Bearer resource_metadata=\"{prmUrl}\"");
+ return Results.Empty;
+ }
+
+ // Validate the token
+ string authHeaderValue = authHeader.ToString();
+ bool isValid = await _authProvider.ValidateTokenAsync(authHeaderValue);
+ if (!isValid)
+ {
+ // Invalid token, return 401 Unauthorized
+ var prm = _authProvider.GetProtectedResourceMetadata();
+ var prmUrl = GetPrmUrl(httpContext, prm.Resource);
+
+ _logger.LogDebug("Invalid authorization token, returning 401 Unauthorized");
+ httpContext.Response.StatusCode = StatusCodes.Status401Unauthorized;
+ httpContext.Response.Headers.Append("WWW-Authenticate", $"Bearer resource_metadata=\"{prmUrl}\"");
+ return Results.Empty;
+ }
+
+ // Token is valid, proceed to the next filter
+ return await next(context);
+ }
+
+ ///
+ /// Builds the URL for the protected resource metadata endpoint.
+ ///
+ /// The HTTP context.
+ /// The resource URI from the protected resource metadata.
+ /// The full URL to the protected resource metadata endpoint.
+ private static string GetPrmUrl(HttpContext context, string resourceUri)
+ {
+ // Use the actual resource URI from PRM if it's an absolute URL, otherwise build the URL
+ if (Uri.TryCreate(resourceUri, UriKind.Absolute, out _))
+ {
+ return $"{resourceUri.TrimEnd('/')}/.well-known/oauth-protected-resource";
+ }
+
+ // Build the URL from the current request
+ var request = context.Request;
+ var scheme = request.Scheme;
+ var host = request.Host.Value;
+ return $"{scheme}://{host}/.well-known/oauth-protected-resource";
+ }
+}
diff --git a/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs b/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs
index 56ae7b82..51df44bd 100644
--- a/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs
+++ b/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs
@@ -66,26 +66,23 @@ public static IEndpointConventionBuilder MapMcp(this IEndpointRouteBuilder endpo
streamableHttpGroup.MapDelete("", streamableHttpHandler.HandleDeleteRequestAsync);
// Map legacy HTTP with SSE endpoints.
- var sseHandler = endpoints.ServiceProvider.GetRequiredService();
- var sseGroup = mcpGroup.MapGroup("")
+ var sseHandler = endpoints.ServiceProvider.GetRequiredService(); var sseGroup = mcpGroup.MapGroup("")
.WithDisplayName(b => $"MCP HTTP with SSE | {b.DisplayName}");
- // Apply authorization filter to SSE endpoints if authorization is configured
- if (authProvider != null)
- {
- // Create the filter factory
- var filterFactory = endpoints.ServiceProvider.GetRequiredService();
-
- // Apply filter to SSE and message endpoints
- sseGroup.AddEndpointFilterFactory(filterFactory.Create);
- }
-
- sseGroup.MapGet("/sse", sseHandler.HandleSseRequestAsync)
+ // Configure SSE endpoints
+ var sseEndpoint = sseGroup.MapGet("/sse", sseHandler.HandleSseRequestAsync)
.WithMetadata(new ProducesResponseTypeMetadata(StatusCodes.Status200OK, contentTypes: ["text/event-stream"]));
- sseGroup.MapPost("/message", sseHandler.HandleMessageRequestAsync)
+
+ var messageEndpoint = sseGroup.MapPost("/message", sseHandler.HandleMessageRequestAsync)
.WithMetadata(new AcceptsMetadata(["application/json"]))
.WithMetadata(new ProducesResponseTypeMetadata(StatusCodes.Status202Accepted));
+ // Apply authorization filter directly to SSE endpoints if authorization is configured
+ if (authProvider != null)
+ {
+ // Apply authorization to both endpoints using the extension method
+ new[] { sseEndpoint, messageEndpoint }.AddMcpAuthorization(authProvider, endpoints.ServiceProvider);
+ }
return mcpGroup;
}
-}
+}
\ No newline at end of file
diff --git a/src/ModelContextProtocol/Protocol/Transport/SseClientSessionTransport.cs b/src/ModelContextProtocol/Protocol/Transport/SseClientSessionTransport.cs
index b9e8c6c0..c083764a 100644
--- a/src/ModelContextProtocol/Protocol/Transport/SseClientSessionTransport.cs
+++ b/src/ModelContextProtocol/Protocol/Transport/SseClientSessionTransport.cs
@@ -1,11 +1,9 @@
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Logging.Abstractions;
-using ModelContextProtocol.Protocol.Auth;
using ModelContextProtocol.Protocol.Messages;
using ModelContextProtocol.Utils;
using ModelContextProtocol.Utils.Json;
using System.Diagnostics;
-using System.Net;
using System.Net.Http.Headers;
using System.Net.ServerSentEvents;
using System.Text;
@@ -26,7 +24,6 @@ internal sealed partial class SseClientSessionTransport : TransportBase
private Task? _receiveTask;
private readonly ILogger _logger;
private readonly TaskCompletionSource _connectionEstablished;
- private readonly IAuthorizationHandler _authorizationHandler;
///
/// SSE transport for client endpoints. Unlike stdio it does not launch a process, but connects to an existing server.
@@ -48,18 +45,6 @@ public SseClientSessionTransport(SseClientTransportOptions transportOptions, Htt
_connectionCts = new CancellationTokenSource();
_logger = (ILogger?)loggerFactory?.CreateLogger() ?? NullLogger.Instance;
_connectionEstablished = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
-
- // Initialize the authorization handler
- if (transportOptions.AuthorizationOptions?.AuthorizationHandler != null)
- {
- // Use explicitly provided handler
- _authorizationHandler = transportOptions.AuthorizationOptions.AuthorizationHandler;
- }
- else
- {
- // Create default handler with auth options
- _authorizationHandler = new DefaultAuthorizationHandler(loggerFactory, transportOptions.AuthorizationOptions);
- }
}
///
@@ -89,48 +74,18 @@ public override async Task SendMessageAsync(
if (_messageEndpoint == null)
throw new InvalidOperationException("Transport not connected");
+ using var content = new StringContent(
+ JsonSerializer.Serialize(message, McpJsonUtilities.JsonContext.Default.JsonRpcMessage),
+ Encoding.UTF8,
+ "application/json"
+ );
+
string messageId = "(no id)";
if (message is JsonRpcMessageWithId messageWithId)
{
messageId = messageWithId.Id.ToString();
}
-
- // Send the request, handling potential auth challenges
- HttpResponseMessage? response = null;
- bool authRetry = false;
-
- do
- {
- authRetry = false;
-
- // Create a new request for each attempt
- using var currentRequest = new HttpRequestMessage(HttpMethod.Post, _messageEndpoint);
- currentRequest.Content = new StringContent(
- JsonSerializer.Serialize(message, McpJsonUtilities.JsonContext.Default.JsonRpcMessage),
- Encoding.UTF8,
- "application/json"
- );
-
- // Add authorization headers if needed - the handler will only add headers if auth is required
- await _authorizationHandler.AuthenticateRequestAsync(currentRequest).ConfigureAwait(false);
-
- // Copy additional headers
- CopyAdditionalHeaders(currentRequest.Headers);
-
- // Dispose previous response before making a new request
- response?.Dispose();
-
- response = await _httpClient.SendAsync(currentRequest, cancellationToken).ConfigureAwait(false);
-
- // Handle 401 Unauthorized response - this will only execute if the server requires auth
- if (response.StatusCode == HttpStatusCode.Unauthorized)
- {
- // Try to handle the unauthorized response
- authRetry = await _authorizationHandler.HandleUnauthorizedResponseAsync(
- response, _messageEndpoint).ConfigureAwait(false);
- }
- } while (authRetry);
using var httpRequestMessage = new HttpRequestMessage(HttpMethod.Post, _messageEndpoint)
{
@@ -139,25 +94,26 @@ public override async Task SendMessageAsync(
StreamableHttpClientSessionTransport.CopyAdditionalHeaders(httpRequestMessage.Headers, _options.AdditionalHeaders);
var response = await _httpClient.SendAsync(httpRequestMessage, cancellationToken).ConfigureAwait(false);
- var responseContent = await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
+ response.EnsureSuccessStatusCode();
- // Check if the message was an initialize request
- if (message is JsonRpcRequest request && request.Method == RequestMethods.Initialize)
- {
- // If the response is not a JSON-RPC response, it is an SSE message
- if (string.IsNullOrEmpty(responseContent) || responseContent.Equals("accepted", StringComparison.OrdinalIgnoreCase))
- {
- LogAcceptedPost(Name, messageId);
- // The response will arrive as an SSE message
- }
- else
- {
- JsonRpcResponse initializeResponse = JsonSerializer.Deserialize(responseContent, McpJsonUtilities.JsonContext.Default.JsonRpcResponse) ??
- throw new InvalidOperationException("Failed to initialize client");
+ var responseContent = await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
if (string.IsNullOrEmpty(responseContent) || responseContent.Equals("accepted", StringComparison.OrdinalIgnoreCase))
{
- response.Dispose();
+ LogAcceptedPost(Name, messageId);
+ }
+ else
+ {
+ if (_logger.IsEnabled(LogLevel.Trace))
+ {
+ LogRejectedPostSensitive(Name, messageId, responseContent);
+ }
+ else
+ {
+ LogRejectedPost(Name, messageId);
+ }
+
+ throw new InvalidOperationException("Failed to send message");
}
}
From f699f774b013c2b115aab9445f29acef9f8fbc7e Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 12:42:01 -0700
Subject: [PATCH 18/28] Cleanup
---
.../McpAuthorizationFilter.cs | 79 -------------------
.../McpEndpointAuthorizationFilter.cs | 1 -
2 files changed, 80 deletions(-)
delete mode 100644 src/ModelContextProtocol.AspNetCore/McpAuthorizationFilter.cs
diff --git a/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilter.cs b/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilter.cs
deleted file mode 100644
index be5f0a72..00000000
--- a/src/ModelContextProtocol.AspNetCore/McpAuthorizationFilter.cs
+++ /dev/null
@@ -1,79 +0,0 @@
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.Logging;
-using ModelContextProtocol.Protocol.Auth;
-
-namespace ModelContextProtocol.AspNetCore;
-
-///
-/// An endpoint filter that handles authorization for MCP endpoints.
-///
-internal class McpAuthorizationFilter : IEndpointFilter
-{
- private readonly ILogger _logger;
- private readonly IServerAuthorizationProvider _authProvider;
-
- ///
- /// Initializes a new instance of the class.
- ///
- /// The logger.
- /// The authorization provider.
- public McpAuthorizationFilter(
- ILogger logger,
- IServerAuthorizationProvider authProvider)
- {
- _logger = logger ?? throw new ArgumentNullException(nameof(logger));
- _authProvider = authProvider ?? throw new ArgumentNullException(nameof(authProvider));
- }
-
- ///
- public async ValueTask InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
- {
- var httpContext = context.HttpContext;
-
- // Check if the Authorization header is present
- if (!httpContext.Request.Headers.TryGetValue("Authorization", out var authHeader) || string.IsNullOrEmpty(authHeader))
- {
- // No Authorization header present, return 401 Unauthorized
- var prm = _authProvider.GetProtectedResourceMetadata();
- var prmUrl = GetPrmUrl(httpContext, prm.Resource);
-
- _logger.LogDebug("Authorization required, returning 401 Unauthorized with WWW-Authenticate header");
- httpContext.Response.StatusCode = StatusCodes.Status401Unauthorized;
- httpContext.Response.Headers.Append("WWW-Authenticate", $"Bearer resource_metadata=\"{prmUrl}\"");
- return Results.Empty;
- }
-
- // Validate the token - ensuring authHeader is a non-null string
- string authHeaderValue = authHeader.ToString();
- bool isValid = await _authProvider.ValidateTokenAsync(authHeaderValue);
- if (!isValid)
- {
- // Invalid token, return 401 Unauthorized
- var prm = _authProvider.GetProtectedResourceMetadata();
- var prmUrl = GetPrmUrl(httpContext, prm.Resource);
-
- _logger.LogDebug("Invalid authorization token, returning 401 Unauthorized");
- httpContext.Response.StatusCode = StatusCodes.Status401Unauthorized;
- httpContext.Response.Headers.Append("WWW-Authenticate", $"Bearer resource_metadata=\"{prmUrl}\"");
- return Results.Empty;
- }
-
- // Token is valid, proceed to the next filter
- return await next(context);
- }
-
- private static string GetPrmUrl(HttpContext context, string resourceUri)
- {
- // Use the actual resource URI from PRM if it's an absolute URL, otherwise build the URL
- if (Uri.TryCreate(resourceUri, UriKind.Absolute, out _))
- {
- return $"{resourceUri.TrimEnd('/')}/.well-known/oauth-protected-resource";
- }
-
- // Build the URL from the current request
- var request = context.Request;
- var scheme = request.Scheme;
- var host = request.Host.Value;
- return $"{scheme}://{host}/.well-known/oauth-protected-resource";
- }
-}
diff --git a/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs b/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
index f0ebe5df..992b0745 100644
--- a/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
+++ b/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
@@ -1,4 +1,3 @@
-// filepath: c:\Users\ddelimarsky\source\csharp-sdk\src\ModelContextProtocol.AspNetCore\McpEndpointAuthorizationFilter.cs
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Logging;
using ModelContextProtocol.Protocol.Auth;
From dc8f3a1fa6552bd149fb246e3fc2a3dcc19b1773 Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 16:30:10 -0700
Subject: [PATCH 19/28] Bit more cleanup here.
---
.../Protocol/Auth/AuthorizationContext.cs | 2 +-
.../Protocol/Auth/AuthorizationService.cs | 4 +-
.../Auth/ProtectedResourceMetadata.cs | 19 +--
.../Protocol/Auth/ResourceMetadata.cs | 39 ------
.../Utils/Json/McpJsonUtilities.cs | 1 -
.../Auth/ProtectedResourceMetadataTests.cs | 114 ++++++++++++++++++
6 files changed, 120 insertions(+), 59 deletions(-)
delete mode 100644 src/ModelContextProtocol/Protocol/Auth/ResourceMetadata.cs
create mode 100644 tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
diff --git a/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs b/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
index df4c8e59..a23da864 100644
--- a/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
@@ -8,7 +8,7 @@ internal class AuthorizationContext
///
/// Gets or sets the resource metadata.
///
- public ResourceMetadata? ResourceMetadata { get; set; }
+ public ProtectedResourceMetadata? ResourceMetadata { get; set; }
///
/// Gets or sets the authorization server metadata.
diff --git a/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs b/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
index 8db6028a..e3c506b6 100644
--- a/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
@@ -26,7 +26,7 @@ public class AuthorizationService
///
/// The HTTP response that contains the WWW-Authenticate header.
/// A that represents the asynchronous operation. The task result contains the resource metadata if available.
- public static async Task GetResourceMetadataFromResponseAsync(HttpResponseMessage response)
+ public static async Task GetResourceMetadataFromResponseAsync(HttpResponseMessage response)
{
if (response.StatusCode != HttpStatusCode.Unauthorized)
{
@@ -71,7 +71,7 @@ public class AuthorizationService
// Read as string first, then deserialize using source-generated serializer
using var reader = new StreamReader(contentStream);
var json = await reader.ReadToEndAsync();
- return JsonSerializer.Deserialize(json, McpJsonUtilities.JsonContext.Default.ResourceMetadata);
+ return JsonSerializer.Deserialize(json, McpJsonUtilities.JsonContext.Default.ProtectedResourceMetadata);
}
catch (Exception)
{
diff --git a/src/ModelContextProtocol/Protocol/Auth/ProtectedResourceMetadata.cs b/src/ModelContextProtocol/Protocol/Auth/ProtectedResourceMetadata.cs
index 7194b1b0..e80d58ad 100644
--- a/src/ModelContextProtocol/Protocol/Auth/ProtectedResourceMetadata.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/ProtectedResourceMetadata.cs
@@ -17,13 +17,13 @@ public class ProtectedResourceMetadata
/// Gets or sets the resource identifier URI.
///
[JsonPropertyName("resource")]
- public required string Resource { get; set; }
+ public required Uri Resource { get; set; }
///
/// Gets or sets the authorization servers that can be used for authentication.
///
[JsonPropertyName("authorization_servers")]
- public required string[] AuthorizationServers { get; set; }
+ public required Uri[] AuthorizationServers { get; set; }
///
/// Gets or sets the bearer token methods supported by the resource.
@@ -41,18 +41,5 @@ public class ProtectedResourceMetadata
/// Gets or sets the URL to the resource documentation.
///
[JsonPropertyName("resource_documentation")]
- public string? ResourceDocumentation { get; set; }
-
- ///
- /// Converts this to the internal type.
- ///
- /// A instance with the same values as this instance.
- internal ResourceMetadata ToResourceMetadata() => new()
- {
- Resource = Resource,
- AuthorizationServers = AuthorizationServers,
- BearerMethodsSupported = BearerMethodsSupported,
- ScopesSupported = ScopesSupported,
- ResourceDocumentation = ResourceDocumentation
- };
+ public Uri? ResourceDocumentation { get; set; }
}
\ No newline at end of file
diff --git a/src/ModelContextProtocol/Protocol/Auth/ResourceMetadata.cs b/src/ModelContextProtocol/Protocol/Auth/ResourceMetadata.cs
deleted file mode 100644
index a57456c3..00000000
--- a/src/ModelContextProtocol/Protocol/Auth/ResourceMetadata.cs
+++ /dev/null
@@ -1,39 +0,0 @@
-using System.Text.Json.Serialization;
-
-namespace ModelContextProtocol.Protocol.Auth;
-
-///
-/// Represents the resource metadata from the WWW-Authenticate header in a 401 Unauthorized response.
-///
-public class ResourceMetadata
-{
- ///
- /// Gets or sets the resource identifier URI.
- ///
- [JsonPropertyName("resource")]
- public required string Resource { get; set; }
-
- ///
- /// Gets or sets the authorization servers that can be used for authentication.
- ///
- [JsonPropertyName("authorization_servers")]
- public required string[] AuthorizationServers { get; set; }
-
- ///
- /// Gets or sets the bearer token methods supported by the resource.
- ///
- [JsonPropertyName("bearer_methods_supported")]
- public string[]? BearerMethodsSupported { get; set; }
-
- ///
- /// Gets or sets the scopes supported by the resource.
- ///
- [JsonPropertyName("scopes_supported")]
- public string[]? ScopesSupported { get; set; }
-
- ///
- /// Gets or sets the URL to the resource documentation.
- ///
- [JsonPropertyName("resource_documentation")]
- public string? ResourceDocumentation { get; set; }
-}
\ No newline at end of file
diff --git a/src/ModelContextProtocol/Utils/Json/McpJsonUtilities.cs b/src/ModelContextProtocol/Utils/Json/McpJsonUtilities.cs
index 169b27e3..30226f01 100644
--- a/src/ModelContextProtocol/Utils/Json/McpJsonUtilities.cs
+++ b/src/ModelContextProtocol/Utils/Json/McpJsonUtilities.cs
@@ -124,7 +124,6 @@ internal static bool IsValidMcpToolSchema(JsonElement element)
[JsonSerializable(typeof(IReadOnlyDictionary))]
// Authorization-related types
- [JsonSerializable(typeof(Protocol.Auth.ResourceMetadata))]
[JsonSerializable(typeof(Protocol.Auth.ProtectedResourceMetadata))]
[JsonSerializable(typeof(Protocol.Auth.AuthorizationServerMetadata))]
[JsonSerializable(typeof(Protocol.Auth.ClientMetadata))]
diff --git a/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs b/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
new file mode 100644
index 00000000..68df6940
--- /dev/null
+++ b/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
@@ -0,0 +1,114 @@
+// filepath: c:\Users\ddelimarsky\source\csharp-sdk\tests\ModelContextProtocol.Tests\Protocol\Auth\ProtectedResourceMetadataTests.cs
+using ModelContextProtocol.Protocol.Auth;
+using System.Text.Json;
+
+namespace ModelContextProtocol.Tests.Protocol.Auth;
+
+public class ProtectedResourceMetadataTests
+{
+ [Fact]
+ public void ProtectedResourceMetadata_JsonSerialization_Works()
+ {
+ // Arrange
+ var metadata = new ProtectedResourceMetadata
+ {
+ Resource = new Uri("http://localhost:7071"),
+ AuthorizationServers = [new Uri("https://login.microsoftonline.com/tenant/v2.0")],
+ BearerMethodsSupported = ["header"],
+ ScopesSupported = ["mcp.tools", "mcp.prompts"],
+ ResourceDocumentation = new Uri("https://example.com/docs")
+ };
+
+ // Act
+ var json = JsonSerializer.Serialize(metadata);
+ var deserialized = JsonSerializer.Deserialize(json);
+
+ // Assert
+ Assert.NotNull(deserialized);
+ Assert.Equal("http://localhost:7071", deserialized.Resource.ToString());
+ Assert.Equal("https://login.microsoftonline.com/tenant/v2.0", deserialized.AuthorizationServers[0].ToString());
+ Assert.Equal("header", deserialized.BearerMethodsSupported![0]);
+ Assert.Equal(2, deserialized.ScopesSupported!.Length);
+ Assert.Contains("mcp.tools", deserialized.ScopesSupported!);
+ Assert.Contains("mcp.prompts", deserialized.ScopesSupported!);
+ Assert.Equal("https://example.com/docs", deserialized.ResourceDocumentation!.ToString());
+ }
+
+ [Fact]
+ public void ProtectedResourceMetadata_JsonDeserialization_WorksWithStringProperties()
+ {
+ // Arrange
+ var json = @"{
+ ""resource"": ""http://localhost:7071"",
+ ""authorization_servers"": [""https://login.microsoftonline.com/tenant/v2.0""],
+ ""bearer_methods_supported"": [""header""],
+ ""scopes_supported"": [""mcp.tools"", ""mcp.prompts""],
+ ""resource_documentation"": ""https://example.com/docs""
+ }";
+
+ // Act
+ var deserialized = JsonSerializer.Deserialize(json);
+
+ // Assert
+ Assert.NotNull(deserialized);
+ Assert.Equal("http://localhost:7071", deserialized.Resource.ToString());
+ Assert.Equal("https://login.microsoftonline.com/tenant/v2.0", deserialized.AuthorizationServers[0].ToString());
+ Assert.Equal("header", deserialized.BearerMethodsSupported![0]);
+ Assert.Equal(2, deserialized.ScopesSupported!.Length);
+ Assert.Contains("mcp.tools", deserialized.ScopesSupported!);
+ Assert.Contains("mcp.prompts", deserialized.ScopesSupported!);
+ Assert.Equal("https://example.com/docs", deserialized.ResourceDocumentation!.ToString());
+ }
+
+ [Fact]
+ public void ResourceMetadata_JsonSerialization_Works()
+ {
+ // Arrange
+ var metadata = new ResourceMetadata
+ {
+ Resource = new Uri("http://localhost:7071"),
+ AuthorizationServers = [new Uri("https://login.microsoftonline.com/tenant/v2.0")],
+ BearerMethodsSupported = ["header"],
+ ScopesSupported = ["mcp.tools", "mcp.prompts"],
+ ResourceDocumentation = new Uri("https://example.com/docs")
+ };
+
+ // Act
+ var json = JsonSerializer.Serialize(metadata);
+ var deserialized = JsonSerializer.Deserialize(json);
+
+ // Assert
+ Assert.NotNull(deserialized);
+ Assert.Equal("http://localhost:7071", deserialized.Resource.ToString());
+ Assert.Equal("https://login.microsoftonline.com/tenant/v2.0", deserialized.AuthorizationServers[0].ToString());
+ Assert.Equal("header", deserialized.BearerMethodsSupported![0]);
+ Assert.Equal(2, deserialized.ScopesSupported!.Length);
+ Assert.Contains("mcp.tools", deserialized.ScopesSupported!);
+ Assert.Contains("mcp.prompts", deserialized.ScopesSupported!);
+ Assert.Equal("https://example.com/docs", deserialized.ResourceDocumentation!.ToString());
+ }
+
+ [Fact]
+ public void ToResourceMetadata_ConversionWorks()
+ {
+ // Arrange
+ var prm = new ProtectedResourceMetadata
+ {
+ Resource = new Uri("http://localhost:7071"),
+ AuthorizationServers = [new Uri("https://login.microsoftonline.com/tenant/v2.0")],
+ BearerMethodsSupported = ["header"],
+ ScopesSupported = ["mcp.tools", "mcp.prompts"],
+ ResourceDocumentation = new Uri("https://example.com/docs")
+ };
+
+ // Act
+ var resourceMetadata = prm.ToResourceMetadata();
+
+ // Assert
+ Assert.Equal(prm.Resource, resourceMetadata.Resource);
+ Assert.Equal(prm.AuthorizationServers, resourceMetadata.AuthorizationServers);
+ Assert.Equal(prm.BearerMethodsSupported, resourceMetadata.BearerMethodsSupported);
+ Assert.Equal(prm.ScopesSupported, resourceMetadata.ScopesSupported);
+ Assert.Equal(prm.ResourceDocumentation, resourceMetadata.ResourceDocumentation);
+ }
+}
From 7c2e1777a6a2ab382a3c2d411fb47df17f3728ca Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 16:30:44 -0700
Subject: [PATCH 20/28] Remove test that is no longer relevant
---
.../Auth/ProtectedResourceMetadataTests.cs | 24 -------------------
1 file changed, 24 deletions(-)
diff --git a/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs b/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
index 68df6940..d711e255 100644
--- a/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
+++ b/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
@@ -87,28 +87,4 @@ public void ResourceMetadata_JsonSerialization_Works()
Assert.Contains("mcp.prompts", deserialized.ScopesSupported!);
Assert.Equal("https://example.com/docs", deserialized.ResourceDocumentation!.ToString());
}
-
- [Fact]
- public void ToResourceMetadata_ConversionWorks()
- {
- // Arrange
- var prm = new ProtectedResourceMetadata
- {
- Resource = new Uri("http://localhost:7071"),
- AuthorizationServers = [new Uri("https://login.microsoftonline.com/tenant/v2.0")],
- BearerMethodsSupported = ["header"],
- ScopesSupported = ["mcp.tools", "mcp.prompts"],
- ResourceDocumentation = new Uri("https://example.com/docs")
- };
-
- // Act
- var resourceMetadata = prm.ToResourceMetadata();
-
- // Assert
- Assert.Equal(prm.Resource, resourceMetadata.Resource);
- Assert.Equal(prm.AuthorizationServers, resourceMetadata.AuthorizationServers);
- Assert.Equal(prm.BearerMethodsSupported, resourceMetadata.BearerMethodsSupported);
- Assert.Equal(prm.ScopesSupported, resourceMetadata.ScopesSupported);
- Assert.Equal(prm.ResourceDocumentation, resourceMetadata.ResourceDocumentation);
- }
}
From c88e473f3425a37c1747f96b7225279342e09fd5 Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 17:24:51 -0700
Subject: [PATCH 21/28] Use URI properly
---
samples/AuthorizationServerExample/Program.cs | 6 +--
.../McpEndpointAuthorizationFilter.cs | 23 ++-------
.../Protocol/Auth/AuthorizationContext.cs | 32 ++++++------
.../Protocol/Auth/AuthorizationService.cs | 50 ++++++++++++-------
.../Auth/DefaultAuthorizationHandler.cs | 38 ++++++--------
.../Auth/ProtectedResourceMetadataTests.cs | 4 +-
6 files changed, 70 insertions(+), 83 deletions(-)
diff --git a/samples/AuthorizationServerExample/Program.cs b/samples/AuthorizationServerExample/Program.cs
index ac375fff..e81ba0b6 100644
--- a/samples/AuthorizationServerExample/Program.cs
+++ b/samples/AuthorizationServerExample/Program.cs
@@ -23,11 +23,11 @@ public static async Task Main(string[] args)
// This is the information that will be provided to clients when they need to authenticate
var prm = new ProtectedResourceMetadata
{
- Resource = "http://localhost:7071", // Changed from HTTPS to HTTP for local development
- AuthorizationServers = ["https://login.microsoftonline.com/a2213e1c-e51e-4304-9a0d-effe57f31655/v2.0"], // Let's use a dummy Entra ID tenant here
+ Resource = new Uri("http://localhost:7071"), // Changed from HTTPS to HTTP for local development
+ AuthorizationServers = [ new Uri("https://login.microsoftonline.com/a2213e1c-e51e-4304-9a0d-effe57f31655/v2.0")], // Let's use a dummy Entra ID tenant here
BearerMethodsSupported = ["header"], // We support the Authorization header
ScopesSupported = ["mcp.tools", "mcp.prompts", "mcp.resources"], // Scopes supported by this resource
- ResourceDocumentation = "https://example.com/docs/mcp-server-auth" // Optional documentation URL
+ ResourceDocumentation = new Uri("https://example.com/docs/mcp-server-auth") // Optional documentation URL
};
// 2. Define a token validator function
diff --git a/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs b/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
index 992b0745..4f49face 100644
--- a/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
+++ b/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
@@ -21,9 +21,7 @@ public McpEndpointAuthorizationFilter(ILogger logger, IServerAuthorizationProvid
{
_logger = logger ?? throw new ArgumentNullException(nameof(logger));
_authProvider = authProvider ?? throw new ArgumentNullException(nameof(authProvider));
- }
-
- ///
+ } ///
public async ValueTask InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
{
var httpContext = context.HttpContext;
@@ -58,26 +56,15 @@ public McpEndpointAuthorizationFilter(ILogger logger, IServerAuthorizationProvid
// Token is valid, proceed to the next filter
return await next(context);
- }
-
- ///
+ }///
/// Builds the URL for the protected resource metadata endpoint.
///
/// The HTTP context.
/// The resource URI from the protected resource metadata.
/// The full URL to the protected resource metadata endpoint.
- private static string GetPrmUrl(HttpContext context, string resourceUri)
+ private static string GetPrmUrl(HttpContext context, Uri resourceUri)
{
- // Use the actual resource URI from PRM if it's an absolute URL, otherwise build the URL
- if (Uri.TryCreate(resourceUri, UriKind.Absolute, out _))
- {
- return $"{resourceUri.TrimEnd('/')}/.well-known/oauth-protected-resource";
- }
-
- // Build the URL from the current request
- var request = context.Request;
- var scheme = request.Scheme;
- var host = request.Host.Value;
- return $"{scheme}://{host}/.well-known/oauth-protected-resource";
+ // Create a new URI with the well-known path appended
+ return new Uri(resourceUri, ".well-known/oauth-protected-resource").ToString();
}
}
diff --git a/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs b/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
index a23da864..f9c39811 100644
--- a/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
@@ -62,36 +62,32 @@ internal class AuthorizationContext
// Since HasValidToken checks that TokenResponse isn't null, we should never have null here,
// but we'll add an explicit null check to satisfy the compiler
return TokenResponse?.AccessToken;
- }
-
+ }
+
///
/// Gets a value indicating whether a refresh token is available for refreshing the access token.
///
public bool CanRefreshToken => TokenResponse?.RefreshToken != null &&
ClientRegistration != null &&
AuthorizationServerMetadata != null;
-
+
///
- /// Validates the URL of a resource against the resource URL from the metadata.
+ /// Validates a URI resource against the resource URI from the metadata.
///
- /// The URL to validate.
- /// True if the URLs match, otherwise false.
- public bool ValidateResourceUrl(string resourceUrl)
+ /// The URI to validate.
+ /// True if the URIs match based on scheme and server components, otherwise false.
+ public bool ValidateResourceUrl(Uri resourceUri)
{
- if (ResourceMetadata == null || string.IsNullOrEmpty(ResourceMetadata.Resource))
+ if (ResourceMetadata == null || ResourceMetadata.Resource == null || resourceUri == null)
{
return false;
}
- // Compare the host part (FQDN) rather than the full URL
- if (Uri.TryCreate(resourceUrl, UriKind.Absolute, out Uri? resourceUri) &&
- Uri.TryCreate(ResourceMetadata.Resource, UriKind.Absolute, out Uri? metadataUri))
- {
- // Compare only the host (domain name)
- return string.Equals(resourceUri.Host, metadataUri.Host, StringComparison.OrdinalIgnoreCase);
- }
-
- // If we can't parse both URLs, fall back to exact string comparison
- return string.Equals(resourceUrl, ResourceMetadata.Resource, StringComparison.OrdinalIgnoreCase);
+ // Use Uri.Compare to properly compare the scheme and server components
+ // UriComponents.SchemeAndServer includes the scheme, host, port, and user info
+ // This handles edge cases like default ports, IPv6 addresses, etc.
+ return Uri.Compare(resourceUri, ResourceMetadata.Resource,
+ UriComponents.SchemeAndServer, UriFormat.UriEscaped,
+ StringComparison.OrdinalIgnoreCase) == 0;
}
}
\ No newline at end of file
diff --git a/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs b/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
index e3c506b6..11753423 100644
--- a/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
@@ -78,26 +78,21 @@ public class AuthorizationService
// Failed to get resource metadata
return null;
}
- }
-
- ///
+ } ///
/// Discovers authorization server metadata from a well-known endpoint.
///
- /// The base URL of the authorization server.
+ /// The base URL of the authorization server (as a string or Uri).
/// A that represents the asynchronous operation. The task result contains the authorization server metadata.
/// Thrown when both well-known endpoints return errors.
- public static async Task DiscoverAuthorizationServerMetadataAsync(string authorizationServerUrl)
+ public static async Task DiscoverAuthorizationServerMetadataAsync(Uri authorizationServerUrl)
{
- Throw.IfNullOrWhiteSpace(authorizationServerUrl);
-
- // Remove trailing slash if present
- if (authorizationServerUrl.EndsWith("/"))
- {
- authorizationServerUrl = authorizationServerUrl[..^1];
- }
+ Throw.IfNull(authorizationServerUrl);
+ // Create a base URI without any path, query, or fragment
+ var baseUri = new Uri($"{authorizationServerUrl.Scheme}://{authorizationServerUrl.Authority}");
+
// Try OpenID Connect discovery endpoint
- var openIdConfigUrl = $"{authorizationServerUrl}/.well-known/openid-configuration";
+ var openIdConfigUrl = new Uri(baseUri, ".well-known/openid-configuration");
try
{
using var openIdResponse = await s_httpClient.GetAsync(openIdConfigUrl);
@@ -124,8 +119,7 @@ public static async Task DiscoverAuthorizationServe
}
// Try OAuth 2.0 Authorization Server Metadata endpoint
- var oauthConfigUrl = $"{authorizationServerUrl}/.well-known/oauth-authorization-server";
- try
+ var oauthConfigUrl = new Uri(baseUri, ".well-known/oauth-authorization-server"); try
{
using var oauthResponse = await s_httpClient.GetAsync(oauthConfigUrl);
if (oauthResponse.IsSuccessStatusCode)
@@ -148,13 +142,31 @@ public static async Task DiscoverAuthorizationServe
catch (Exception ex) when (ex is not InvalidOperationException)
{
// Failed to get OAuth configuration
- }
-
- throw new InvalidOperationException(
- "Failed to discover authorization server metadata. " +
+ } throw new InvalidOperationException(
+ $"Failed to discover authorization server metadata for {authorizationServerUrl}. " +
"Neither OpenID Connect nor OAuth 2.0 well-known endpoints are available.");
}
+ ///
+ /// Discovers authorization server metadata from a well-known endpoint.
+ ///
+ /// The base URL of the authorization server as a string.
+ /// A that represents the asynchronous operation. The task result contains the authorization server metadata.
+ /// Thrown when both well-known endpoints return errors.
+ /// Thrown when the URL is invalid.
+ public static Task DiscoverAuthorizationServerMetadataAsync(string authorizationServerUrl)
+ {
+ Throw.IfNullOrWhiteSpace(authorizationServerUrl);
+
+ // Create a Uri from the string and call the Uri-based method
+ if (Uri.TryCreate(authorizationServerUrl, UriKind.Absolute, out Uri? uri))
+ {
+ return DiscoverAuthorizationServerMetadataAsync(uri);
+ }
+
+ throw new ArgumentException("Invalid URI format", nameof(authorizationServerUrl));
+ }
+
///
/// Registers a client with the authorization server.
///
diff --git a/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs b/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs
index 326f82fb..7f3bbe78 100644
--- a/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs
@@ -94,36 +94,31 @@ public async Task HandleUnauthorizedResponseAsync(HttpResponseMessage resp
ResourceUri = serverUri.ToString()
};
throw exception;
- }
-
- // Store the resource metadata in the context before validating the resource URL
+ } // Store the resource metadata in the context before validating the resource URL
authContext.Value.ResourceMetadata = resourceMetadata;
// Validate that the resource matches the server FQDN
- if (!authContext.Value.ValidateResourceUrl(serverUri.ToString()))
+ if (!authContext.Value.ValidateResourceUrl(serverUri))
{
_logger.LogWarning("Resource URL mismatch: expected {Expected}, got {Actual}",
serverUri, resourceMetadata.Resource);
var exception = new AuthorizationException($"Resource URL mismatch: expected {serverUri}, got {resourceMetadata.Resource}");
- exception.ResourceUri = resourceMetadata.Resource;
+ exception.ResourceUri = resourceMetadata.Resource.ToString();
throw exception;
}
// Get the first authorization server from the metadata
if (resourceMetadata.AuthorizationServers == null || resourceMetadata.AuthorizationServers.Length == 0)
- {
- _logger.LogWarning("No authorization servers found in resource metadata");
+ { _logger.LogWarning("No authorization servers found in resource metadata");
var exception = new AuthorizationException("No authorization servers available");
- exception.ResourceUri = resourceMetadata.Resource;
+ exception.ResourceUri = resourceMetadata.Resource.ToString();
throw exception;
}
var authServerUrl = resourceMetadata.AuthorizationServers[0];
- _logger.LogDebug("Using authorization server: {AuthServerUrl}", authServerUrl);
-
- try
+ _logger.LogDebug("Using authorization server: {AuthServerUrl}", authServerUrl); try
{
// Discover authorization server metadata
var authServerMetadata = await AuthorizationService.DiscoverAuthorizationServerMetadataAsync(authServerUrl);
@@ -164,12 +159,11 @@ public async Task HandleUnauthorizedResponseAsync(HttpResponseMessage resp
else
{
_logger.LogWarning("Authorization server does not support dynamic client registration and no client ID was provided");
-
- var exception = new AuthorizationException(
+ var exception = new AuthorizationException(
"Authorization server does not support dynamic client registration and no client ID was provided. " +
"Use McpAuthorizationOptions.ClientId to provide a pre-registered client ID.");
- exception.ResourceUri = resourceMetadata.Resource;
- exception.AuthorizationServerUri = authServerUrl;
+ exception.ResourceUri = resourceMetadata.Resource.ToString();
+ exception.AuthorizationServerUri = authServerUrl.ToString();
throw exception;
}
@@ -177,12 +171,11 @@ public async Task HandleUnauthorizedResponseAsync(HttpResponseMessage resp
if (_authorizeCallback == null)
{
_logger.LogWarning("No authorization callback provided, can't proceed with OAuth flow");
-
- var exception = new AuthorizationException(
+ var exception = new AuthorizationException(
"Authentication is required but no authorization callback was provided. " +
"Use McpAuthorizationOptions.AuthorizeCallback to provide a callback function.");
- exception.ResourceUri = resourceMetadata.Resource;
- exception.AuthorizationServerUri = authServerUrl;
+ exception.ResourceUri = resourceMetadata.Resource.ToString();
+ exception.AuthorizationServerUri = authServerUrl.ToString();
throw exception;
}
@@ -229,12 +222,11 @@ public async Task HandleUnauthorizedResponseAsync(HttpResponseMessage resp
catch (Exception ex) when (ex is not AuthorizationException)
{
_logger.LogError(ex, "Failed to complete authorization flow");
-
- var authException = new AuthorizationException(
+ var authException = new AuthorizationException(
$"Failed to complete authorization flow: {ex.Message}", ex, McpErrorCode.InvalidRequest);
- authException.ResourceUri = resourceMetadata.Resource;
- authException.AuthorizationServerUri = authServerUrl;
+ authException.ResourceUri = resourceMetadata.Resource.ToString();
+ authException.AuthorizationServerUri = authServerUrl.ToString();
throw authException;
}
diff --git a/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs b/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
index d711e255..4b47d7d4 100644
--- a/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
+++ b/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
@@ -64,7 +64,7 @@ public void ProtectedResourceMetadata_JsonDeserialization_WorksWithStringPropert
public void ResourceMetadata_JsonSerialization_Works()
{
// Arrange
- var metadata = new ResourceMetadata
+ var metadata = new ProtectedResourceMetadata
{
Resource = new Uri("http://localhost:7071"),
AuthorizationServers = [new Uri("https://login.microsoftonline.com/tenant/v2.0")],
@@ -75,7 +75,7 @@ public void ResourceMetadata_JsonSerialization_Works()
// Act
var json = JsonSerializer.Serialize(metadata);
- var deserialized = JsonSerializer.Deserialize(json);
+ var deserialized = JsonSerializer.Deserialize(json);
// Assert
Assert.NotNull(deserialized);
From 4d379914ae8d84b3be18244ab09f3ca01b08e5c7 Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 17:38:52 -0700
Subject: [PATCH 22/28] Functional cleanup
---
.../AuthorizationMiddleware.cs | 19 +--------------
.../McpEndpointAuthorizationFilter.cs | 24 ++++---------------
.../ProtectedResourceMetadataHandler.cs | 18 ++++++++++++--
3 files changed, 22 insertions(+), 39 deletions(-)
diff --git a/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs b/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
index d11bdf11..c2d88958 100644
--- a/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
+++ b/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
@@ -58,25 +58,8 @@ await JsonSerializer.SerializeAsync(
authProvider.GetProtectedResourceMetadata(),
McpJsonUtilities.DefaultOptions.GetTypeInfo(typeof(ProtectedResourceMetadata)));
return;
- }
-
- // Proceed to the next middleware - authorization for SSE and message endpoints
+ } // Proceed to the next middleware - authorization for SSE and message endpoints
// is now handled by endpoint filters
await _next(context);
}
-
- private static string GetPrmUrl(HttpContext context, string resourceUri)
- {
- // Use the actual resource URI from PRM if it's an absolute URL, otherwise build the URL
- if (Uri.TryCreate(resourceUri, UriKind.Absolute, out _))
- {
- return $"{resourceUri.TrimEnd('/')}/.well-known/oauth-protected-resource";
- }
-
- // Build the URL from the current request
- var request = context.Request;
- var scheme = request.Scheme;
- var host = request.Host.Value;
- return $"{scheme}://{host}/.well-known/oauth-protected-resource";
- }
}
\ No newline at end of file
diff --git a/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs b/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
index 4f49face..0d6e47eb 100644
--- a/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
+++ b/src/ModelContextProtocol.AspNetCore/McpEndpointAuthorizationFilter.cs
@@ -28,10 +28,9 @@ public McpEndpointAuthorizationFilter(ILogger logger, IServerAuthorizationProvid
// Check if the Authorization header is present
if (!httpContext.Request.Headers.TryGetValue("Authorization", out var authHeader) || string.IsNullOrEmpty(authHeader))
- {
- // No Authorization header present, return 401 Unauthorized
+ { // No Authorization header present, return 401 Unauthorized
var prm = _authProvider.GetProtectedResourceMetadata();
- var prmUrl = GetPrmUrl(httpContext, prm.Resource);
+ var prmUrl = ProtectedResourceMetadataHandler.GetProtectedResourceMetadataUrl(prm.Resource);
_logger.LogDebug("Authorization required, returning 401 Unauthorized with WWW-Authenticate header");
httpContext.Response.StatusCode = StatusCodes.Status401Unauthorized;
@@ -43,28 +42,15 @@ public McpEndpointAuthorizationFilter(ILogger logger, IServerAuthorizationProvid
string authHeaderValue = authHeader.ToString();
bool isValid = await _authProvider.ValidateTokenAsync(authHeaderValue);
if (!isValid)
- {
- // Invalid token, return 401 Unauthorized
+ { // Invalid token, return 401 Unauthorized
var prm = _authProvider.GetProtectedResourceMetadata();
- var prmUrl = GetPrmUrl(httpContext, prm.Resource);
+ var prmUrl = ProtectedResourceMetadataHandler.GetProtectedResourceMetadataUrl(prm.Resource);
_logger.LogDebug("Invalid authorization token, returning 401 Unauthorized");
httpContext.Response.StatusCode = StatusCodes.Status401Unauthorized;
httpContext.Response.Headers.Append("WWW-Authenticate", $"Bearer resource_metadata=\"{prmUrl}\"");
return Results.Empty;
- }
-
- // Token is valid, proceed to the next filter
+ } // Token is valid, proceed to the next filter
return await next(context);
- }///
- /// Builds the URL for the protected resource metadata endpoint.
- ///
- /// The HTTP context.
- /// The resource URI from the protected resource metadata.
- /// The full URL to the protected resource metadata endpoint.
- private static string GetPrmUrl(HttpContext context, Uri resourceUri)
- {
- // Create a new URI with the well-known path appended
- return new Uri(resourceUri, ".well-known/oauth-protected-resource").ToString();
}
}
diff --git a/src/ModelContextProtocol.AspNetCore/ProtectedResourceMetadataHandler.cs b/src/ModelContextProtocol.AspNetCore/ProtectedResourceMetadataHandler.cs
index ae9c87d9..5f0d2452 100644
--- a/src/ModelContextProtocol.AspNetCore/ProtectedResourceMetadataHandler.cs
+++ b/src/ModelContextProtocol.AspNetCore/ProtectedResourceMetadataHandler.cs
@@ -33,12 +33,26 @@ public ProtectedResourceMetadataHandler(
/// The HTTP context.
/// A task that represents the asynchronous operation.
public async Task HandleAsync(HttpContext context)
- {
- _logger.LogDebug("Serving Protected Resource Metadata document");
+ { _logger.LogDebug("Serving Protected Resource Metadata document");
context.Response.ContentType = "application/json";
await JsonSerializer.SerializeAsync(
context.Response.Body,
_authProvider.GetProtectedResourceMetadata(),
McpJsonUtilities.DefaultOptions.GetTypeInfo(typeof(ProtectedResourceMetadata)));
+ } ///
+ /// Builds the URL for the protected resource metadata endpoint.
+ ///
+ /// The resource URI from the protected resource metadata.
+ /// The full URL to the protected resource metadata endpoint.
+ /// Thrown when resourceUri is null.
+ public static string GetProtectedResourceMetadataUrl(Uri resourceUri)
+ {
+ if (resourceUri == null)
+ {
+ throw new ArgumentNullException(nameof(resourceUri), "Resource URI must be provided to build the protected resource metadata URL.");
+ }
+
+ // Create a new URI with the well-known path appended
+ return new Uri(resourceUri, ".well-known/oauth-protected-resource").ToString();
}
}
From 084590dc02c328fbeb640e5223a3a30c42a17190 Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 18:00:10 -0700
Subject: [PATCH 23/28] Update ProtectedResourceMetadataTests.cs
---
.../Auth/ProtectedResourceMetadataTests.cs | 46 ++++---------------
1 file changed, 10 insertions(+), 36 deletions(-)
diff --git a/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs b/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
index 4b47d7d4..76a7d8aa 100644
--- a/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
+++ b/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
@@ -1,6 +1,8 @@
-// filepath: c:\Users\ddelimarsky\source\csharp-sdk\tests\ModelContextProtocol.Tests\Protocol\Auth\ProtectedResourceMetadataTests.cs
using ModelContextProtocol.Protocol.Auth;
+using ModelContextProtocol.Utils.Json;
+using System;
using System.Text.Json;
+using Xunit;
namespace ModelContextProtocol.Tests.Protocol.Auth;
@@ -25,15 +27,15 @@ public void ProtectedResourceMetadata_JsonSerialization_Works()
// Assert
Assert.NotNull(deserialized);
- Assert.Equal("http://localhost:7071", deserialized.Resource.ToString());
- Assert.Equal("https://login.microsoftonline.com/tenant/v2.0", deserialized.AuthorizationServers[0].ToString());
+ Assert.Equal(metadata.Resource, deserialized.Resource);
+ Assert.Equal(metadata.AuthorizationServers[0], deserialized.AuthorizationServers[0]);
Assert.Equal("header", deserialized.BearerMethodsSupported![0]);
Assert.Equal(2, deserialized.ScopesSupported!.Length);
Assert.Contains("mcp.tools", deserialized.ScopesSupported!);
Assert.Contains("mcp.prompts", deserialized.ScopesSupported!);
- Assert.Equal("https://example.com/docs", deserialized.ResourceDocumentation!.ToString());
+ Assert.Equal(metadata.ResourceDocumentation, deserialized.ResourceDocumentation);
}
-
+
[Fact]
public void ProtectedResourceMetadata_JsonDeserialization_WorksWithStringProperties()
{
@@ -51,40 +53,12 @@ public void ProtectedResourceMetadata_JsonDeserialization_WorksWithStringPropert
// Assert
Assert.NotNull(deserialized);
- Assert.Equal("http://localhost:7071", deserialized.Resource.ToString());
- Assert.Equal("https://login.microsoftonline.com/tenant/v2.0", deserialized.AuthorizationServers[0].ToString());
- Assert.Equal("header", deserialized.BearerMethodsSupported![0]);
- Assert.Equal(2, deserialized.ScopesSupported!.Length);
- Assert.Contains("mcp.tools", deserialized.ScopesSupported!);
- Assert.Contains("mcp.prompts", deserialized.ScopesSupported!);
- Assert.Equal("https://example.com/docs", deserialized.ResourceDocumentation!.ToString());
- }
-
- [Fact]
- public void ResourceMetadata_JsonSerialization_Works()
- {
- // Arrange
- var metadata = new ProtectedResourceMetadata
- {
- Resource = new Uri("http://localhost:7071"),
- AuthorizationServers = [new Uri("https://login.microsoftonline.com/tenant/v2.0")],
- BearerMethodsSupported = ["header"],
- ScopesSupported = ["mcp.tools", "mcp.prompts"],
- ResourceDocumentation = new Uri("https://example.com/docs")
- };
-
- // Act
- var json = JsonSerializer.Serialize(metadata);
- var deserialized = JsonSerializer.Deserialize(json);
-
- // Assert
- Assert.NotNull(deserialized);
- Assert.Equal("http://localhost:7071", deserialized.Resource.ToString());
- Assert.Equal("https://login.microsoftonline.com/tenant/v2.0", deserialized.AuthorizationServers[0].ToString());
+ Assert.Equal(new Uri("http://localhost:7071"), deserialized.Resource);
+ Assert.Equal(new Uri("https://login.microsoftonline.com/tenant/v2.0"), deserialized.AuthorizationServers[0]);
Assert.Equal("header", deserialized.BearerMethodsSupported![0]);
Assert.Equal(2, deserialized.ScopesSupported!.Length);
Assert.Contains("mcp.tools", deserialized.ScopesSupported!);
Assert.Contains("mcp.prompts", deserialized.ScopesSupported!);
- Assert.Equal("https://example.com/docs", deserialized.ResourceDocumentation!.ToString());
+ Assert.Equal(new Uri("https://example.com/docs"), deserialized.ResourceDocumentation);
}
}
From f9f7c9da3a773b10f4c899c566de7e8e9c29e652 Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 18:00:29 -0700
Subject: [PATCH 24/28] Update ProtectedResourceMetadataTests.cs
---
.../Protocol/Auth/ProtectedResourceMetadataTests.cs | 3 ---
1 file changed, 3 deletions(-)
diff --git a/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs b/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
index 76a7d8aa..e4af9c91 100644
--- a/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
+++ b/tests/ModelContextProtocol.Tests/Protocol/Auth/ProtectedResourceMetadataTests.cs
@@ -1,8 +1,5 @@
using ModelContextProtocol.Protocol.Auth;
-using ModelContextProtocol.Utils.Json;
-using System;
using System.Text.Json;
-using Xunit;
namespace ModelContextProtocol.Tests.Protocol.Auth;
From 3676c0e7c44cefbbb6fe0075d4e8a072b5ed079e Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 18:02:24 -0700
Subject: [PATCH 25/28] Update for consistency
---
.../Protocol/Auth/AuthorizationContext.cs | 4 ++--
.../Protocol/Auth/AuthorizationService.cs | 12 ++++++------
...RegistrationResponse.cs => ClientRegistration.cs} | 2 +-
.../Protocol/Auth/DefaultAuthorizationHandler.cs | 2 +-
.../Protocol/Auth/{TokenResponse.cs => Token.cs} | 2 +-
.../Utils/Json/McpJsonUtilities.cs | 4 ++--
6 files changed, 13 insertions(+), 13 deletions(-)
rename src/ModelContextProtocol/Protocol/Auth/{ClientRegistrationResponse.cs => ClientRegistration.cs} (96%)
rename src/ModelContextProtocol/Protocol/Auth/{TokenResponse.cs => Token.cs} (97%)
diff --git a/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs b/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
index f9c39811..c8e36c2f 100644
--- a/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs
@@ -18,12 +18,12 @@ internal class AuthorizationContext
///
/// Gets or sets the client registration response.
///
- public ClientRegistrationResponse? ClientRegistration { get; set; }
+ public ClientRegistration? ClientRegistration { get; set; }
///
/// Gets or sets the token response.
///
- public TokenResponse? TokenResponse { get; set; }
+ public Token? TokenResponse { get; set; }
///
/// Gets or sets the code verifier for PKCE.
diff --git a/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs b/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
index 11753423..16ff917c 100644
--- a/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/AuthorizationService.cs
@@ -174,7 +174,7 @@ public static Task DiscoverAuthorizationServerMetad
/// The client metadata for registration.
/// A that represents the asynchronous operation. The task result contains the client registration response.
/// Thrown when the authorization server does not support dynamic client registration.
- public static async Task RegisterClientAsync(
+ public static async Task RegisterClientAsync(
AuthorizationServerMetadata metadata,
ClientMetadata clientMetadata)
{
@@ -198,7 +198,7 @@ public static async Task RegisterClientAsync(
var contentStream = await response.Content.ReadAsStreamAsync();
using var reader = new StreamReader(contentStream);
var json = await reader.ReadToEndAsync();
- var result = JsonSerializer.Deserialize(json, McpJsonUtilities.JsonContext.Default.ClientRegistrationResponse);
+ var result = JsonSerializer.Deserialize(json, McpJsonUtilities.JsonContext.Default.ClientRegistration);
if (result == null)
{
@@ -288,7 +288,7 @@ public static string CreateAuthorizationUrl(
/// The authorization code received from the authorization server.
/// The code verifier for PKCE.
/// A that represents the asynchronous operation. The task result contains the token response.
- public static async Task ExchangeCodeForTokensAsync(
+ public static async Task ExchangeCodeForTokensAsync(
AuthorizationServerMetadata metadata,
string clientId,
string? clientSecret,
@@ -330,7 +330,7 @@ public static async Task ExchangeCodeForTokensAsync(
var contentStream = await response.Content.ReadAsStreamAsync();
using var reader = new StreamReader(contentStream);
var json = await reader.ReadToEndAsync();
- var result = JsonSerializer.Deserialize(json, McpJsonUtilities.JsonContext.Default.TokenResponse);
+ var result = JsonSerializer.Deserialize(json, McpJsonUtilities.JsonContext.Default.Token);
if (result == null)
{
@@ -348,7 +348,7 @@ public static async Task ExchangeCodeForTokensAsync(
/// The client secret.
/// The refresh token.
/// A that represents the asynchronous operation. The task result contains the token response.
- public static async Task RefreshTokenAsync(
+ public static async Task RefreshTokenAsync(
AuthorizationServerMetadata metadata,
string clientId,
string? clientSecret,
@@ -384,7 +384,7 @@ public static async Task RefreshTokenAsync(
var contentStream = await response.Content.ReadAsStreamAsync();
using var reader = new StreamReader(contentStream);
var json = await reader.ReadToEndAsync();
- var result = JsonSerializer.Deserialize(json, McpJsonUtilities.JsonContext.Default.TokenResponse);
+ var result = JsonSerializer.Deserialize(json, McpJsonUtilities.JsonContext.Default.Token);
if (result == null)
{
diff --git a/src/ModelContextProtocol/Protocol/Auth/ClientRegistrationResponse.cs b/src/ModelContextProtocol/Protocol/Auth/ClientRegistration.cs
similarity index 96%
rename from src/ModelContextProtocol/Protocol/Auth/ClientRegistrationResponse.cs
rename to src/ModelContextProtocol/Protocol/Auth/ClientRegistration.cs
index d7042b3a..d4e66b98 100644
--- a/src/ModelContextProtocol/Protocol/Auth/ClientRegistrationResponse.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/ClientRegistration.cs
@@ -5,7 +5,7 @@ namespace ModelContextProtocol.Protocol.Auth;
///
/// Represents the OAuth 2.0 client registration response as defined in RFC 7591.
///
-public class ClientRegistrationResponse
+public class ClientRegistration
{
///
/// Gets or sets the OAuth 2.0 client identifier string.
diff --git a/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs b/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs
index 7f3bbe78..c10286f3 100644
--- a/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs
@@ -140,7 +140,7 @@ public async Task HandleUnauthorizedResponseAsync(HttpResponseMessage resp
_logger.LogDebug("Using pre-configured client ID: {ClientId}", _clientId);
// Create a client registration response to store in the context
- var clientRegistration = new ClientRegistrationResponse
+ var clientRegistration = new ClientRegistration
{
ClientId = _clientId!, // Using null-forgiving operator since we've already checked it's not null
ClientSecret = _clientSecret,
diff --git a/src/ModelContextProtocol/Protocol/Auth/TokenResponse.cs b/src/ModelContextProtocol/Protocol/Auth/Token.cs
similarity index 97%
rename from src/ModelContextProtocol/Protocol/Auth/TokenResponse.cs
rename to src/ModelContextProtocol/Protocol/Auth/Token.cs
index d6b33489..f9559068 100644
--- a/src/ModelContextProtocol/Protocol/Auth/TokenResponse.cs
+++ b/src/ModelContextProtocol/Protocol/Auth/Token.cs
@@ -5,7 +5,7 @@ namespace ModelContextProtocol.Protocol.Auth;
///
/// Represents the OAuth 2.0 token response as defined in RFC 6749.
///
-public class TokenResponse
+public class Token
{
///
/// Gets or sets the access token issued by the authorization server.
diff --git a/src/ModelContextProtocol/Utils/Json/McpJsonUtilities.cs b/src/ModelContextProtocol/Utils/Json/McpJsonUtilities.cs
index 30226f01..7b33940b 100644
--- a/src/ModelContextProtocol/Utils/Json/McpJsonUtilities.cs
+++ b/src/ModelContextProtocol/Utils/Json/McpJsonUtilities.cs
@@ -127,8 +127,8 @@ internal static bool IsValidMcpToolSchema(JsonElement element)
[JsonSerializable(typeof(Protocol.Auth.ProtectedResourceMetadata))]
[JsonSerializable(typeof(Protocol.Auth.AuthorizationServerMetadata))]
[JsonSerializable(typeof(Protocol.Auth.ClientMetadata))]
- [JsonSerializable(typeof(Protocol.Auth.ClientRegistrationResponse))]
- [JsonSerializable(typeof(Protocol.Auth.TokenResponse))]
+ [JsonSerializable(typeof(Protocol.Auth.ClientRegistration))]
+ [JsonSerializable(typeof(Protocol.Auth.Token))]
[ExcludeFromCodeCoverage]
internal sealed partial class JsonContext : JsonSerializerContext;
From 950a3c450f8fb268c8fd28c5b1eb89859fd91efb Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 18:04:45 -0700
Subject: [PATCH 26/28] Cleanup
---
samples/AuthorizationServerExample/Program.cs | 2 +-
...ationProvider.cs => BasicServerAuthorizationProvider.cs} | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
rename src/ModelContextProtocol/Server/Auth/{SimpleServerAuthorizationProvider.cs => BasicServerAuthorizationProvider.cs} (88%)
diff --git a/samples/AuthorizationServerExample/Program.cs b/samples/AuthorizationServerExample/Program.cs
index e81ba0b6..921f8355 100644
--- a/samples/AuthorizationServerExample/Program.cs
+++ b/samples/AuthorizationServerExample/Program.cs
@@ -40,7 +40,7 @@ async Task ValidateToken(string token)
}
// 3. Create an authorization provider with the PRM and token validator
- var authProvider = new SimpleServerAuthorizationProvider(prm, ValidateToken);
+ var authProvider = new BasicServerAuthorizationProvider(prm, ValidateToken);
// 4. Configure the MCP server with authorization
builder.Services.AddMcpServer(options =>
diff --git a/src/ModelContextProtocol/Server/Auth/SimpleServerAuthorizationProvider.cs b/src/ModelContextProtocol/Server/Auth/BasicServerAuthorizationProvider.cs
similarity index 88%
rename from src/ModelContextProtocol/Server/Auth/SimpleServerAuthorizationProvider.cs
rename to src/ModelContextProtocol/Server/Auth/BasicServerAuthorizationProvider.cs
index fdd9b925..48950ea1 100644
--- a/src/ModelContextProtocol/Server/Auth/SimpleServerAuthorizationProvider.cs
+++ b/src/ModelContextProtocol/Server/Auth/BasicServerAuthorizationProvider.cs
@@ -3,7 +3,7 @@
namespace ModelContextProtocol.Server.Auth;
///
-/// A simple implementation of that validates bearer tokens.
+/// A basic implementation of .
///
///
/// This implementation is intended as a starting point for server developers. In production environments,
@@ -11,12 +11,12 @@ namespace ModelContextProtocol.Server.Auth;
/// authentication system (e.g., OAuth 2.0 server, identity provider, etc.)
///
///
-/// Initializes a new instance of the class
+/// Initializes a new instance of the class
/// with the specified resource metadata and token validator.
///
/// The protected resource metadata.
/// A function that validates access tokens. If not provided, a function that always returns true will be used.
-public class SimpleServerAuthorizationProvider(
+public class BasicServerAuthorizationProvider(
ProtectedResourceMetadata resourceMetadata,
Func>? tokenValidator = null) : IServerAuthorizationProvider
{
From e8b3e0d916f82c4ff10caafbeb31c91571eb2ff9 Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 19:37:39 -0700
Subject: [PATCH 27/28] Cleanup
---
samples/AuthorizationServerExample/Program.cs | 21 +++++------
.../AuthorizationExtensions.cs | 3 ++
.../AuthorizationMiddleware.cs | 7 ++--
.../HttpMcpServerBuilderExtensions.cs | 6 ++-
.../McpAuthorizationStartupFilter.cs | 37 +++++++++++++++++++
.../McpEndpointRouteBuilderExtensions.cs | 9 +++--
.../McpServerAuthorizationExtensions.cs | 20 +++++++---
7 files changed, 77 insertions(+), 26 deletions(-)
create mode 100644 src/ModelContextProtocol.AspNetCore/McpAuthorizationStartupFilter.cs
diff --git a/samples/AuthorizationServerExample/Program.cs b/samples/AuthorizationServerExample/Program.cs
index 921f8355..c58e8b03 100644
--- a/samples/AuthorizationServerExample/Program.cs
+++ b/samples/AuthorizationServerExample/Program.cs
@@ -1,5 +1,5 @@
using ModelContextProtocol;
-using ModelContextProtocol.AspNetCore;
+using ModelContextProtocol.Configuration;
using ModelContextProtocol.Protocol.Auth;
using ModelContextProtocol.Protocol.Types;
using ModelContextProtocol.Server.Auth;
@@ -40,9 +40,12 @@ async Task ValidateToken(string token)
}
// 3. Create an authorization provider with the PRM and token validator
- var authProvider = new BasicServerAuthorizationProvider(prm, ValidateToken);
-
- // 4. Configure the MCP server with authorization
+ var authProvider = new BasicServerAuthorizationProvider(prm, ValidateToken); // 4. Configure the MCP server with authorization
+ // WithAuthorization will automatically configure:
+ // - Authorization provider registration
+ // - Protected resource metadata endpoint (/.well-known/oauth-protected-resource)
+ // - Token validation middleware
+ // - Authorization for all MCP endpoints
builder.Services.AddMcpServer(options =>
{
options.ServerInstructions = "This is an MCP server with OAuth authorization enabled.";
@@ -106,14 +109,8 @@ async Task ValidateToken(string token)
var app = builder.Build();
- // 5. Enable authorization middleware (this must be before MapMcp)
- // This middleware does several things:
- // - Serves the PRM document at /.well-known/oauth-protected-resource
- // - Checks Authorization header on requests
- // - Returns 401 + WWW-Authenticate when authorization is missing or invalid
- app.UseMcpAuthorization();
-
- // 6. Map MCP endpoints
+ // 5. Map MCP endpoints
+ // Note: Authorization is now handled automatically by WithAuthorization()
app.MapMcp();
// Configure the server URL
diff --git a/src/ModelContextProtocol.AspNetCore/AuthorizationExtensions.cs b/src/ModelContextProtocol.AspNetCore/AuthorizationExtensions.cs
index 16f93e98..7fd62a81 100644
--- a/src/ModelContextProtocol.AspNetCore/AuthorizationExtensions.cs
+++ b/src/ModelContextProtocol.AspNetCore/AuthorizationExtensions.cs
@@ -10,6 +10,9 @@ public static class AuthorizationExtensions
///
/// Adds MCP authorization middleware to the specified , which enables
/// OAuth 2.0 authorization for MCP servers.
+ ///
+ /// Note: This method is called automatically when using WithAuthorization(), so you typically
+ /// don't need to call it directly. It's available for advanced scenarios where more control is needed.
///
/// The to add the middleware to.
/// A reference to this instance after the operation has completed.
diff --git a/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs b/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
index c2d88958..45fd9347 100644
--- a/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
+++ b/src/ModelContextProtocol.AspNetCore/AuthorizationMiddleware.cs
@@ -25,9 +25,7 @@ public AuthorizationMiddleware(RequestDelegate next, ILogger
+ } ///
/// Processes a request.
///
/// The HTTP context.
@@ -42,6 +40,7 @@ public async Task InvokeAsync(
// Check if authorization is configured
if (authProvider == null)
{
+ _logger.LogDebug("Authorization is not configured, skipping authorization middleware");
// Authorization is not configured, proceed to the next middleware
await _next(context);
return;
@@ -54,7 +53,7 @@ public async Task InvokeAsync(
_logger.LogDebug("Serving Protected Resource Metadata document");
context.Response.ContentType = "application/json";
await JsonSerializer.SerializeAsync(
- context.Response.Body,
+ context.Response.Body,
authProvider.GetProtectedResourceMetadata(),
McpJsonUtilities.DefaultOptions.GetTypeInfo(typeof(ProtectedResourceMetadata)));
return;
diff --git a/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs b/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs
index 32fc5341..ec74cdf0 100644
--- a/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs
+++ b/src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs
@@ -1,4 +1,5 @@
-using Microsoft.Extensions.DependencyInjection.Extensions;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.DependencyInjection.Extensions;
using ModelContextProtocol.AspNetCore;
using ModelContextProtocol.Server;
@@ -27,6 +28,9 @@ public static IMcpServerBuilder WithHttpTransport(this IMcpServerBuilder builder
builder.Services.TryAddSingleton();
builder.Services.AddHostedService();
+ // Add our auto-registration for the authorization middleware
+ builder.Services.AddTransient();
+
if (configureOptions is not null)
{
builder.Services.Configure(configureOptions);
diff --git a/src/ModelContextProtocol.AspNetCore/McpAuthorizationStartupFilter.cs b/src/ModelContextProtocol.AspNetCore/McpAuthorizationStartupFilter.cs
new file mode 100644
index 00000000..64b70280
--- /dev/null
+++ b/src/ModelContextProtocol.AspNetCore/McpAuthorizationStartupFilter.cs
@@ -0,0 +1,37 @@
+// filepath: c:\Users\ddelimarsky\source\csharp-sdk\src\ModelContextProtocol.AspNetCore\McpAuthorizationStartupFilter.cs
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.DependencyInjection;
+using ModelContextProtocol.Protocol.Auth;
+using System;
+
+namespace ModelContextProtocol.AspNetCore;
+
+///
+/// StartupFilter that automatically adds the MCP authorization middleware when authorization is configured.
+///
+internal class McpAuthorizationStartupFilter : IStartupFilter
+{
+ ///
+ /// Configures the middleware pipeline to include MCP authorization middleware when needed.
+ ///
+ /// The next configurator in the chain.
+ /// A new pipeline configuration action.
+ public Action Configure(Action next)
+ {
+ return app =>
+ {
+ // Check if authorization provider is registered
+ bool hasAuthProvider = app.ApplicationServices.GetService() != null;
+
+ // If authorization is configured, add the middleware
+ if (hasAuthProvider)
+ {
+ app.UseMcpAuthorization();
+ }
+
+ // Continue with the rest of the pipeline configuration
+ next(app);
+ };
+ }
+}
diff --git a/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs b/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs
index 51df44bd..a3cc9fb5 100644
--- a/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs
+++ b/src/ModelContextProtocol.AspNetCore/McpEndpointRouteBuilderExtensions.cs
@@ -75,13 +75,14 @@ public static IEndpointConventionBuilder MapMcp(this IEndpointRouteBuilder endpo
var messageEndpoint = sseGroup.MapPost("/message", sseHandler.HandleMessageRequestAsync)
.WithMetadata(new AcceptsMetadata(["application/json"]))
- .WithMetadata(new ProducesResponseTypeMetadata(StatusCodes.Status202Accepted));
-
- // Apply authorization filter directly to SSE endpoints if authorization is configured
+ .WithMetadata(new ProducesResponseTypeMetadata(StatusCodes.Status202Accepted)); // Apply authorization filter directly to the endpoints if authorization is configured
if (authProvider != null)
{
- // Apply authorization to both endpoints using the extension method
+ // Apply authorization to both SSE endpoints using the extension method
new[] { sseEndpoint, messageEndpoint }.AddMcpAuthorization(authProvider, endpoints.ServiceProvider);
+
+ // Apply authorization to the Streamable HTTP endpoints using the extension method
+ streamableHttpGroup.AddMcpAuthorization(authProvider, endpoints.ServiceProvider);
}
return mcpGroup;
}
diff --git a/src/ModelContextProtocol/Configuration/McpServerAuthorizationExtensions.cs b/src/ModelContextProtocol/Configuration/McpServerAuthorizationExtensions.cs
index 7592b5e9..cb9a7435 100644
--- a/src/ModelContextProtocol/Configuration/McpServerAuthorizationExtensions.cs
+++ b/src/ModelContextProtocol/Configuration/McpServerAuthorizationExtensions.cs
@@ -1,29 +1,39 @@
+using Microsoft.Extensions.DependencyInjection;
using ModelContextProtocol.Protocol.Auth;
using ModelContextProtocol.Protocol.Types;
using ModelContextProtocol.Server;
using ModelContextProtocol.Utils;
-namespace Microsoft.Extensions.DependencyInjection;
+namespace ModelContextProtocol.Configuration;
///
/// Extension methods for configuring authorization in MCP servers.
///
public static class McpServerAuthorizationExtensions
-{
+{
///
- /// Adds authorization support to the MCP server.
+ /// Adds authorization support to the MCP server and automatically configures the required middleware.
+ /// You don't need to call UseMcpAuthorization() separately - it will be handled automatically.
///
/// The to configure.
/// The authorization provider that will validate tokens and provide metadata.
/// The so that additional calls can be chained.
/// or is .
+ ///
+ /// This method automatically configures all the necessary components for authorization:
+ /// 1. Registers the authorization provider in the DI container
+ /// 2. Configures authorization middleware to serve the protected resource metadata
+ /// 3. Adds authorization to MCP endpoints when they are mapped
+ ///
+ /// You no longer need to call app.UseMcpAuthorization() explicitly.
+ ///
public static IMcpServerBuilder WithAuthorization(
this IMcpServerBuilder builder,
IServerAuthorizationProvider authorizationProvider)
{
Throw.IfNull(builder);
- Throw.IfNull(authorizationProvider);
-
+ Throw.IfNull(authorizationProvider);
+
// Register the authorization provider in the DI container
builder.Services.AddSingleton(authorizationProvider);
From e80bad2db398999e5d6e4bc86aed6ab33c0759b3 Mon Sep 17 00:00:00 2001
From: "den (work)" <53200638+localden@users.noreply.github.com>
Date: Thu, 1 May 2025 19:44:37 -0700
Subject: [PATCH 28/28] Update Program.cs
---
samples/AuthorizationExample/Program.cs | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/samples/AuthorizationExample/Program.cs b/samples/AuthorizationExample/Program.cs
index 42b1c83c..a7c34950 100644
--- a/samples/AuthorizationExample/Program.cs
+++ b/samples/AuthorizationExample/Program.cs
@@ -36,7 +36,8 @@ public static async Task Main(string[] args)
RedirectUris = new[]
{
$"http://{hostname}:{port}{callbackPath}"
- }, // Configure the authorize callback with the same hostname, port, and path
+ },
+ // Configure the authorize callback with the same hostname, port, and path
AuthorizeCallback = AuthorizationService.CreateHttpListenerAuthorizeCallback(
openBrowser: async (url) =>
{