Repository navigation
Validate the issuer of machine-to-machine providers as an issuer URL - #682
Open
koic wants to merge 1 commit into
Conversation
## Motivation and Context `issuer:` on `ClientCredentialsProvider` and `CrossAppAccessProvider` accepted any non-empty String. A value that is not an issuer URL can never match the metadata of an authorization server, so such credentials were refused at the first request with a message about a different authorization server, far from the configuration that caused it. The flow accepts an authorization server over HTTPS, or over HTTP on a loopback address, and the option is now held to the same rule at construction, where a mistake is reported with the value that was given. Since the issuer of the metadata is compared as a String, a URI object or a Symbol could never equal it either, nor could an issuer with a query or fragment, which RFC 8414 rules out; both are refused the same way. The Python SDK requires an http(s) scheme on its `issuer`; the rule here is the stricter one the flow already applies to every authorization server URL. ## How Has This Been Tested? test/mcp/client/oauth/client_credentials_provider_test.rb and test/mcp/client/oauth/cross_app_access_provider_test.rb: a bare host, a non-HTTP scheme, a URL without a host, a plain HTTP URL off the loopback, a query, a fragment, a URI object and a Symbol are refused with the new message, and HTTPS and loopback HTTP issuers (IPv6 and an uppercase scheme included) are kept; before the change the String values among them were accepted. ## Breaking Changes None for an `issuer:` that names an authorization server. A value that could never have matched a compliant one (RFC 8414 forbids a query or fragment in an issuer) is refused at construction instead of at the first request.
koic
force-pushed
the
validate_the_issuer_of_machine_to_machine_providers_as_an_issuer_url
branch
from
November 13, 2026 04:37
b44a73c to
247d83b
Compare
atesgoral
approved these changes
Nov 13, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
issuer:onClientCredentialsProviderandCrossAppAccessProvideraccepted any non-empty String. A value that is not an issuer URL can never match the metadata of an authorization server, so such credentials were refused at the first request with a message about a different authorization server, far from the configuration that caused it. The flow accepts an authorization server over HTTPS, or over HTTP on a loopback address, and the option is now held to the same rule at construction, where a mistake is reported with the value that was given. Since the issuer of the metadata is compared as a String, a URI object or a Symbol could never equal it either, nor could an issuer with a query or fragment, which RFC 8414 rules out; both are refused the same way. The Python SDK requires an http(s) scheme on itsissuer; the rule here is the stricter one the flow already applies to every authorization server URL.How Has This Been Tested?
test/mcp/client/oauth/client_credentials_provider_test.rb and test/mcp/client/oauth/cross_app_access_provider_test.rb: a bare host, a non-HTTP scheme, a URL without a host, a plain HTTP URL off the loopback, a query, a fragment, a URI object and a Symbol are refused with the new message, and HTTPS and loopback HTTP issuers (IPv6 and an uppercase scheme included) are kept; before the change the String values among them were accepted.
Breaking Changes
None for an
issuer:that names an authorization server. A value that could never have matched a compliant one (RFC 8414 forbids a query or fragment in an issuer) is refused at construction instead of at the first request.Types of changes
Checklist