feat(auth): add RFC 8707 resource parameter to authorize and token requests#10
Open
Zabari wants to merge 1 commit into
Open
feat(auth): add RFC 8707 resource parameter to authorize and token requests#10Zabari wants to merge 1 commit into
Zabari wants to merge 1 commit into
Conversation
…quests Some authorization servers (e.g. Natoma, used for Atlassian's MCP server) require the OAuth 2.0 `resource` parameter on /authorize and /token to audience-bind the issued access token (RFC 8707, Resource Indicators for OAuth 2.0). Without it they reject the authorization request with `invalid_request` and the browser-based login flow never renders. Forward the AuthorizationManager's `base_url` (the MCP server URL) as the `resource` parameter on both: * the authorization URL produced by `get_authorization_url` * the token-exchange request issued by `exchange_code_for_token` This mirrors the upstream rust-sdk fix (modelcontextprotocol/rust-sdk modelcontextprotocol#651, '11-25-2025 compliant Auth') which threads the same parameter through both call sites. Adds a unit test asserting that `resource` is present in the generated authorize URL and equals the manager's base URL. `cargo test -p rmcp --features=auth --lib transport::auth` => 23 passed. Co-Authored-By: Oz <oz-agent@warp.dev>
Author
|
Tracking issue filed in warpdotdev/warp: warpdotdev/warp#9462 Pinging @oss-maintainers for review — this PR backports just the RFC 8707 |
|
i'm working on migrating us to upstream rmcp, which should take care of this. :) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Forwards the
AuthorizationManager'sbase_url(i.e. the MCP server URL) as the OAuth 2.0resourceparameter (RFC 8707, Resource Indicators for OAuth 2.0) on both:get_authorization_urlexchange_code_for_tokenThis is +13/-1 lines in
crates/rmcp/src/transport/auth.rs, plus a small unit test.Why
Some authorization servers, including Natoma (used for Atlassian's MCP server), require the
resourceparameter to audience-bind the issued access token. Without it, those servers reject the/authorizerequest withinvalid_requestand the browser-based login flow never renders for the user.This change mirrors the upstream rust-sdk fix from modelcontextprotocol/rust-sdk#651 ("11-25-2025 compliant Auth"), where the same two
add_extra_param("resource", ...)calls were threaded through both endpoints. The upstream PR is large because it bundles several other changes (PKCE method verification, SEP-835 scope handling, etc.); this PR is a minimal cherry-pick of just the RFC 8707 part.Test plan
The new test
authorize_url_includes_rfc8707_resource_parameterconstructs anAuthorizationManagerforhttps://mcp.example.com/v1/sse, callsget_authorization_url, and asserts that the resulting URL hasresource=https%3A%2F%2Fmcp.example.com%2Fv1%2Fsse.End-to-end, this unblocks the Atlassian MCP server OAuth flow in Warp once the pinned
rmcprev is bumped to include this commit.Co-Authored-By: Oz oz-agent@warp.dev