Scope HTTP client redirect following to the request's origin - #3075
Open
maxisbey wants to merge 1 commit into
Open
Scope HTTP client redirect following to the request's origin#3075maxisbey wants to merge 1 commit into
maxisbey wants to merge 1 commit into
Claude / Claude Code Review
completed
Jul 8, 2026 in 10m 49s
Code review found 2 potential issues
Found 5 candidates, confirmed 2. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 2 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/mcp/client/auth/oauth2.py:417-421 |
Dead duplicate _handle_protected_resource_response lacks the new redirect check |
| 🟡 Nit | docs/client/transports.md:32 |
transports.md prose contradicts updated tutorial003 snippet |
Annotations
Check warning on line 421 in src/mcp/client/auth/oauth2.py
claude / Claude Code Review
Dead duplicate _handle_protected_resource_response lacks the new redirect check
`OAuthClientProvider._handle_protected_resource_response` (oauth2.py:281) is a near-duplicate of `utils.handle_protected_resource_response` but didn't get the new `has_redirect_location` check, so a 307 through it still raises the old generic `OAuthFlowError` instead of `RedirectError` with guidance. The method is dead code in `src/` (only tests call it), so nothing fails at runtime — consider deleting it (repointing its tests at the utils function) or adding the same check so the two copies don
Check warning on line 32 in docs/client/transports.md
claude / Claude Code Review
transports.md prose contradicts updated tutorial003 snippet
The 'Bring your own `httpx.AsyncClient`' section's prose now contradicts the tutorial003 snippet it embeds: this PR switched the snippet to `create_mcp_http_client`, but line 46 still says to "build the `httpx.AsyncClient` yourself" and the info box still claims "The SDK adds nothing on top and takes nothing away" — no longer true, since the factory adds the same-origin redirect policy (raising `mcp.RedirectError`) and MCP default timeouts. Update the prose (and the `httpx.AsyncClient(auth=OAuth
Loading