fix(auth): stop leaking oauth client secrets (adopted from #327)

fastapi_mcp/auth/proxy.py

@@ -244,23 +244,23 @@ def setup_oauth_fake_dynamic_register_endpoint(
     But, this is an overcomplication for most use cases.
 
     So instead of actually implementing dynamic client registration, we just echo back the pre-registered
-    client ID and secret.
+    client ID and register the caller as a public client.
 
     Use this if you don't need dynamic client registration, or if your OAuth provider doesn't support it.
     """
 
     @app.post(
         path,
         response_model=ClientRegistrationResponse,
+        response_model_exclude_none=True,
         include_in_schema=include_in_schema,
     )
     async def oauth_register_proxy(request: ClientRegistrationRequest) -> ClientRegistrationResponse:
         client_response = ClientRegistrationResponse(
             client_name=request.client_name or "MCP Server",  # Name doesn't really affect functionality
             client_id=client_id,
-            client_secret=client_secret,
             redirect_uris=request.redirect_uris,  # Just echo back their requested URIs
             grant_types=request.grant_types or ["authorization_code"],
-            token_endpoint_auth_method=request.token_endpoint_auth_method or "none",
+            token_endpoint_auth_method="none",
         )
         return client_response

tests/test_auth_proxy.py

@@ -0,0 +1,31 @@
+from fastapi.testclient import TestClient
+
+from fastapi import FastAPI
+
+from fastapi_mcp.auth.proxy import setup_oauth_fake_dynamic_register_endpoint
+
+
+def test_fake_dynamic_registration_does_not_return_client_secret():
+    app = FastAPI()
+    setup_oauth_fake_dynamic_register_endpoint(
+        app=app,
+        client_id="test-client-id",
+        client_secret="super-secret-value",
+    )
+
+    client = TestClient(app)
+    response = client.post(
+        "/oauth/register",
+        json={
+            "redirect_uris": ["https://client.example.com/callback"],
+            "client_name": "Test Client",
+            "token_endpoint_auth_method": "client_secret_post",
+        },
+    )
+
+    assert response.status_code == 200
+    payload = response.json()
+
+    assert payload["client_id"] == "test-client-id"
+    assert "client_secret" not in payload
+    assert payload["token_endpoint_auth_method"] == "none"