From c1846c8482655d5da83a68800fc04ddb2e745249 Mon Sep 17 00:00:00 2001 From: Rudy Celekli Date: Fri, 23 Oct 2026 22:54:32 -0400 Subject: [PATCH 1/2] fix(oauth): drop the query string from the legacy metadata discovery URL --- internal/oauth/discovery.go | 2 +- internal/oauth/discovery_test.go | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/internal/oauth/discovery.go b/internal/oauth/discovery.go index a678aee41..7f8b4bd87 100644 --- a/internal/oauth/discovery.go +++ b/internal/oauth/discovery.go @@ -82,7 +82,7 @@ func BuildRFC8414MetadataURLs(authServerURL string) []string { // Also try legacy path (appending .well-known after path) for backward compatibility // Example: https://auth.smithery.ai/googledrive/.well-known/oauth-authorization-server - legacyURL := strings.TrimSuffix(authServerURL, "/") + "/.well-known/oauth-authorization-server" + legacyURL := baseURL + strings.TrimSuffix(u.EscapedPath(), "/") + "/.well-known/oauth-authorization-server" urls = append(urls, legacyURL) // Also try base URL without path suffix for servers like Cloudflare that host diff --git a/internal/oauth/discovery_test.go b/internal/oauth/discovery_test.go index 7e6c718b7..89bdf1481 100644 --- a/internal/oauth/discovery_test.go +++ b/internal/oauth/discovery_test.go @@ -481,6 +481,15 @@ func TestBuildRFC8414MetadataURLs(t *testing.T) { "https://logs.mcp.cloudflare.com/.well-known/oauth-authorization-server", // This one works for Cloudflare }, }, + { + name: "URL with path and query string", + authServerURL: "https://host.example.com/mcp?token=abc", + expectedURLs: []string{ + "https://host.example.com/.well-known/oauth-authorization-server/mcp", + "https://host.example.com/mcp/.well-known/oauth-authorization-server", + "https://host.example.com/.well-known/oauth-authorization-server", + }, + }, { name: "GitHub OAuth URL without path", authServerURL: "https://github.com", From dbbae9ff032226fedcdb8d8ced43f26d6818c865 Mon Sep 17 00:00:00 2001 From: Algis Dumbris Date: Mon, 26 Oct 2026 13:20:09 +0200 Subject: [PATCH 2/2] fix(oauth): keep URL userinfo on the legacy metadata discovery URL Review finding (P2): rebuilding the legacy candidate as scheme://host + EscapedPath dropped the userinfo, which net/http turns into a Basic Authorization header, so discovery behind a Basic-auth gateway broke. Strip only the query and fragment from a copy of the parsed URL instead. Co-Authored-By: Claude Opus 5.5 --- internal/oauth/discovery.go | 9 ++++++++- internal/oauth/discovery_test.go | 18 ++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/internal/oauth/discovery.go b/internal/oauth/discovery.go index 7f8b4bd87..8892b2435 100644 --- a/internal/oauth/discovery.go +++ b/internal/oauth/discovery.go @@ -82,7 +82,14 @@ func BuildRFC8414MetadataURLs(authServerURL string) []string { // Also try legacy path (appending .well-known after path) for backward compatibility // Example: https://auth.smithery.ai/googledrive/.well-known/oauth-authorization-server - legacyURL := baseURL + strings.TrimSuffix(u.EscapedPath(), "/") + "/.well-known/oauth-authorization-server" + // Strip only the query and fragment: the userinfo (basic-auth + // credentials) must stay, as it did before. + legacy := *u + legacy.RawQuery = "" + legacy.ForceQuery = false + legacy.Fragment = "" + legacy.RawFragment = "" + legacyURL := strings.TrimSuffix(legacy.String(), "/") + "/.well-known/oauth-authorization-server" urls = append(urls, legacyURL) // Also try base URL without path suffix for servers like Cloudflare that host diff --git a/internal/oauth/discovery_test.go b/internal/oauth/discovery_test.go index 89bdf1481..2a3cfe399 100644 --- a/internal/oauth/discovery_test.go +++ b/internal/oauth/discovery_test.go @@ -490,6 +490,24 @@ func TestBuildRFC8414MetadataURLs(t *testing.T) { "https://host.example.com/.well-known/oauth-authorization-server", }, }, + { + name: "URL with userinfo keeps it on the legacy URL", + authServerURL: "https://alice:secret@host.example.com/mcp", + expectedURLs: []string{ + "https://host.example.com/.well-known/oauth-authorization-server/mcp", + "https://alice:secret@host.example.com/mcp/.well-known/oauth-authorization-server", + "https://host.example.com/.well-known/oauth-authorization-server", + }, + }, + { + name: "URL with userinfo and query string", + authServerURL: "https://alice:secret@host.example.com/mcp?token=abc", + expectedURLs: []string{ + "https://host.example.com/.well-known/oauth-authorization-server/mcp", + "https://alice:secret@host.example.com/mcp/.well-known/oauth-authorization-server", + "https://host.example.com/.well-known/oauth-authorization-server", + }, + }, { name: "GitHub OAuth URL without path", authServerURL: "https://github.com",