Skip to content

fix(client): preserve OAuth resource metadata indicator#1989

Open
Genmin wants to merge 4 commits intomodelcontextprotocol:mainfrom
Genmin:fix/oauth-resource-indicator-preserve-metadata
Open

fix(client): preserve OAuth resource metadata indicator#1989
Genmin wants to merge 4 commits intomodelcontextprotocol:mainfrom
Genmin:fix/oauth-resource-indicator-preserve-metadata

Conversation

@Genmin
Copy link
Copy Markdown

@Genmin Genmin commented Apr 30, 2026

Summary

Fixes #1968 by preserving the exact RFC 8707 resource indicator string published in protected resource metadata after validation, instead of serializing it through URL.href and normalizing pathless origins to include a trailing slash.

This keeps resource=https://example.com distinct from resource=https://example.com/ for authorization and token requests, which matters for OAuth providers that treat the resource/audience string literally.

Validation

  • pnpm --filter @modelcontextprotocol/client test -- auth.test.ts
  • pnpm --filter @modelcontextprotocol/client typecheck
  • pnpm --filter @modelcontextprotocol/client lint
  • pnpm --filter @modelcontextprotocol/client build
  • pre-push hook: full workspace typecheck, build, and lint

@Genmin Genmin requested a review from a team as a code owner April 30, 2026 05:32
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 30, 2026

🦋 Changeset detected

Latest commit: 41dd3a1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@modelcontextprotocol/client Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented Apr 30, 2026

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@1989

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@1989

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@1989

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@1989

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@1989

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@1989

commit: 41dd3a1

@Genmin
Copy link
Copy Markdown
Author

Genmin commented Apr 30, 2026

Addressed the remaining build/release blockers:\n\n- Exported OAuthResourceIndicator because it is referenced by public APIs, which clears the TypeDoc warning.\n- Added a patch changeset for @modelcontextprotocol/client.\n\nValidated locally:\n- pnpm run docs:check\n- pnpm --filter @modelcontextprotocol/client typecheck\n- pnpm --filter @modelcontextprotocol/client test\n- pre-push hook: build, lint, typecheck

@Genmin Genmin force-pushed the fix/oauth-resource-indicator-preserve-metadata branch from c22203a to 13e2065 Compare April 30, 2026 16:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OAuth resource indicator from protected resource metadata is normalized with a trailing slash

1 participant