Fix OAuth examples to use complete resource URLs - #3275
Open
0809android wants to merge 6 commits into
Open
Conversation
0809android
marked this pull request as ready for review
August 9, 2026 10:52
There was a problem hiding this comment.
All reported issues were addressed across 12 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
0809android
marked this pull request as draft
August 9, 2026 12:44
0809android
marked this pull request as ready for review
August 9, 2026 13:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1264.
Problem
The OAuth examples did not consistently use the complete MCP endpoint as the resource identifier:
/mcp;/mcpeven when running SSE at/sse; and/mcpsubstring before constructing itsOAuthClientProvider.Strict RFC 9728 clients can reject those mismatches before authorization completes.
Changes
/mcpor/sse) as the simple-auth resource identifier and listening route.MCPServer.run()'s actual default address:http://127.0.0.1:8000/mcp.AuthSettings.resource_server_urlis the complete externally visible MCP endpoint, including mount or proxy prefixes.This PR does not infer or append public paths in SDK code. Internal routes cannot reveal ASGI mount paths or reverse-proxy prefixes. The earlier #2662 explored the same docs/example direction; this revision applies that conclusion to current
mainand adds focused regressions for the current examples.Validation
/mcp, SSE/sse, and exact client URL preservation on asyncio and Trio).SeCreateSymbolicLinkPrivilege(WinError 1314).uv.lockconsistency passed.AI assistance disclosure: I used Codex to inspect #1264 and the prior PR history, implement and test the changes, and reduce the original draft after review. I independently verified the final diff and the validation results above.