Skip to content

fix: normalize OAuth redirect URI URL subtypes - #2744

Closed
he-yufeng wants to merge 1 commit into
modelcontextprotocol:mainfrom
he-yufeng:fix/oauth-redirect-uri-url-subtypes-v2
Closed

fix: normalize OAuth redirect URI URL subtypes#2744
he-yufeng wants to merge 1 commit into
modelcontextprotocol:mainfrom
he-yufeng:fix/oauth-redirect-uri-url-subtypes-v2

Conversation

@he-yufeng

@he-yufeng he-yufeng commented May 31, 2026

Copy link
Copy Markdown

Summary

  • normalize redirect_uris values at the OAuth client metadata boundary
  • keep raw string, AnyUrl, and URL subtype inputs serializing the same way
  • add a regression test for AnyHttpUrl registration followed by AnyUrl redirect validation

To verify

  • .\.venv\Scripts\python.exe -m pytest tests\shared\test_auth.py -q
  • .\.venv\Scripts\python.exe -m ruff check src\mcp\shared\auth.py tests\shared\test_auth.py
  • .\.venv\Scripts\python.exe -m ruff format --check src\mcp\shared\auth.py tests\shared\test_auth.py
  • git diff --check

Refs #2687

@he-yufeng
he-yufeng force-pushed the fix/oauth-redirect-uri-url-subtypes-v2 branch from 062b5b4 to ffea4ae Compare May 31, 2026 23:59
@he-yufeng
he-yufeng force-pushed the fix/oauth-redirect-uri-url-subtypes-v2 branch from ffea4ae to 99b80b5 Compare June 4, 2026 20:42
@he-yufeng

he-yufeng commented Jun 4, 2026

Copy link
Copy Markdown
Author

Covered the additional collection inputs in 99b80b5.

The before-validator now normalizes list, tuple, set, and frozenset redirect URI inputs before Pydantic coerces the field, so URL subtype elements compare correctly after validation.

Validation:

uv run --frozen pytest tests/shared/test_auth.py -q
# 16 passed

uv run --frozen ruff check src/mcp/shared/auth.py tests/shared/test_auth.py
# All checks passed

uv run --frozen ruff format --check src/mcp/shared/auth.py tests/shared/test_auth.py
# 2 files already formatted

uv run --frozen pyright src/mcp/shared/auth.py tests/shared/test_auth.py
# 0 errors

python -m py_compile src\mcp\shared\auth.py tests\shared\test_auth.py

git diff --check

@he-yufeng

he-yufeng commented Jun 10, 2026

Copy link
Copy Markdown
Author

Closing this older redirect URI normalization path in favor of #2808. The newer PR now includes the tuple/set/frozenset collection coverage from this branch, so review can continue on one green, current path.

@he-yufeng he-yufeng closed this Jun 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@he-yufeng