fix: preserve exact OAuth resource indicators - #2581
Merged
KKonstantinov merged 4 commits intoSep 3, 2026
Merged
Conversation
🦋 Changeset detectedLatest commit: de24644 The changes in this PR will be included in the next version bump. This PR includes changesets to release 6 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@modelcontextprotocol/client
@modelcontextprotocol/codemod
@modelcontextprotocol/core
@modelcontextprotocol/server
@modelcontextprotocol/server-legacy
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
hugosmoreira
marked this pull request as ready for review
July 30, 2026 17:12
claude
Bot
added
the
v2
…sourceURL normalization (modelcontextprotocol#1968) - auth.test.ts: drive auth() with PRM `resource: https://example.com` and assert the authorization redirect and the authorization-code token exchange both carry it without a trailing slash (fails on main with 'https://example.com/') - auth.ts: JSDoc on selectResourceURL explaining that it returns a parsed URL and that auth() sends the metadata string verbatim; comment at the decision site in auth() - changeset: describe the trailing-slash normalization, the Entra rejection, the widened `resource` inputs, and that selectResourceURL's signature is unchanged
Contributor
|
@claude review |
KKonstantinov
added a commit
to MukundaKatta/typescript-sdk
that referenced
this pull request
Sep 3, 2026
…resource string from auth() (modelcontextprotocol#1968) Align the v1.x fix with the v2 shape (modelcontextprotocol#2581): the public signature of selectResourceURL stays Promise<URL | undefined>; auth() sends the protected resource metadata's `resource` string verbatim when the provider has no custom validateResourceURL, and the OAuth helpers accept `string | URL` for `resource` via a small resourceIndicatorToString serializer. - auth.test.ts: the regression test now drives both the authorization redirect and the authorization-code token exchange with PRM `resource: https://example.com` and asserts neither gains a trailing slash; add a startAuthorization string case - auth.ts: JSDoc on selectResourceURL and a comment at the decision site in auth() - changeset: describe the normalization, the Entra rejection, the widened inputs, and that selectResourceURL's signature is unchanged
KKonstantinov
approved these changes
Sep 3, 2026
This was referenced Sep 3, 2026
This was referenced Sep 3, 2026
claude Bot
pushed a commit
that referenced
this pull request
Sep 4, 2026
Keep this branch's refreshAuthorization scope option and take main's widened resource type (string | URL) from #2581. Client typecheck, eslint, prettier and full test suite (884 tests) pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01REWQAZGQACRjhFcxCX9g2P
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
URL.hrefnormalization in authorization and token requestsstringorURLresource indicators in the exported OAuth request helpersFixes #1968
Root cause
The default protected-resource flow converted the metadata's
resourcestring to aURLand later serializedURL.href. For origin-only values such ashttps://resource.example.com, that serialization adds a trailing slash, which changes the OAuth resource indicator and can cause authorization servers to reject the request.Custom provider validation remains unchanged: its returned
URLis still used as the selected resource.Validation
pnpm --filter @modelcontextprotocol/client typecheckpnpm --filter @modelcontextprotocol/client buildpnpm --filter @modelcontextprotocol/client test— 798 tests passedMaintainer edit: Supersedes #1989, #1991, and #2518; the end-to-end pathless-PRM regression test and the changeset wording were adapted from #1991.