Skip to content

fix(client): preserve OAuth resource metadata indicator - #1989

Open
Genmin wants to merge 4 commits into
modelcontextprotocol:mainfrom
Genmin:fix/oauth-resource-indicator-preserve-metadata
Open

fix(client): preserve OAuth resource metadata indicator#1989
Genmin wants to merge 4 commits into
modelcontextprotocol:mainfrom
Genmin:fix/oauth-resource-indicator-preserve-metadata

Conversation

@Genmin

@Genmin Genmin commented Apr 30, 2026

Copy link
Copy Markdown

Summary

Fixes #1968 by preserving the exact RFC 8707 resource indicator string published in protected resource metadata after validation, instead of serializing it through URL.href and normalizing pathless origins to include a trailing slash.

This keeps resource=https://example.com distinct from resource=https://example.com/ for authorization and token requests, which matters for OAuth providers that treat the resource/audience string literally.

Validation

  • pnpm --filter @modelcontextprotocol/client test -- auth.test.ts
  • pnpm --filter @modelcontextprotocol/client typecheck
  • pnpm --filter @modelcontextprotocol/client lint
  • pnpm --filter @modelcontextprotocol/client build
  • pre-push hook: full workspace typecheck, build, and lint

@Genmin
Genmin requested a review from a team as a code owner April 30, 2026 05:32
@changeset-bot

changeset-bot Bot commented Apr 30, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 41dd3a1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@modelcontextprotocol/client Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-new Bot commented Apr 30, 2026

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@1989

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@1989

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@1989

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@1989

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@1989

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@1989

commit: 41dd3a1

@Genmin

Genmin commented Apr 30, 2026

Copy link
Copy Markdown
Author

Addressed the remaining build/release blockers:\n\n- Exported OAuthResourceIndicator because it is referenced by public APIs, which clears the TypeDoc warning.\n- Added a patch changeset for @modelcontextprotocol/client.\n\nValidated locally:\n- pnpm run docs:check\n- pnpm --filter @modelcontextprotocol/client typecheck\n- pnpm --filter @modelcontextprotocol/client test\n- pre-push hook: build, lint, typecheck

@Genmin
Genmin force-pushed the fix/oauth-resource-indicator-preserve-metadata branch from c22203a to 13e2065 Compare April 30, 2026 16:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OAuth resource indicator from protected resource metadata is normalized with a trailing slash

1 participant