WWW-Authenticate header does not contain a resource metadata params
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 48/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- csharp
- Domain
- api, authentication
Research direction
Start at ClientOAuthProvider.ExtractProtectedResourceMetadata and follow its call from PerformOAuthAuthorizationAsync in the stack trace. Reproduce the 401 response from the Atlassian Remote MCP Server, then verify that OAuth authorization-server metadata discovery can proceed when WWW-Authenticate lacks a resource_metadata parameter.
Written by the indexing model from the issue text.
Description
Describe the bug
I attempted to connect to the Atlassian Remote MCP Server (https://mcp.atlassian.com/v1/sse) using HttpClientTransport and successfully initialized the client. However, I’m encountering an issue that appears after the initial handshake. The 401-response header’s WWW-Authenticate field does not include the resource metadata parameters. This behavior is present with some other remote MCP servers that also no resource metadata.
I haven’t found a way to bypass this resource metadata check and proceed directly to the authorization server metadata discovery, even though this remote MCP server exposes it at:
https://mcp.atlassian.com/.well-known/oauth-authorization-server
To Reproduce
Steps to reproduce the behavior:
- Create HttpTransportClient with OAuth.
- Initialized the client.
Logs
Unhandled exception. ModelContextProtocol.McpException: The WWW-Authenticate header does not contain a resource_metadata parameter
at ModelContextProtocol.Authentication.ClientOAuthProvider.ExtractProtectedResourceMetadata(HttpResponseMessage response, Uri serverUrl, CancellationToken cancellationToken)
at ModelContextProtocol.Authentication.ClientOAuthProvider.PerformOAuthAuthorizationAsync(HttpResponseMessage response, CancellationToken cancellationToken)
at ModelContextProtocol.Authentication.ClientOAuthProvider.HandleUnauthorizedResponseAsync(String scheme, HttpResponseMessage response, CancellationToken cancellationToken)
at ModelContextProtocol.Authentication.AuthenticatingMcpHttpClient.HandleUnauthorizedResponseAsync(HttpRequestMessage originalRequest, JsonRpcMessage originalJsonRpcMessage, HttpResponseMessage response, CancellationToken cancellationToken)
at ModelContextProtocol.Authentication.AuthenticatingMcpHttpClient.SendAsync(HttpRequestMessage request, JsonRpcMessage message, CancellationToken cancellationToken)
at ModelContextProtocol.Client.StreamableHttpClientSessionTransport.SendHttpRequestAsync(JsonRpcMessage message, CancellationToken cancellationToken)
at ModelContextProtocol.Client.AutoDetectingClientSessionTransport.InitializeAsync(JsonRpcMessage message, CancellationToken cancellationToken)
at ModelContextProtocol.Client.AutoDetectingClientSessionTransport.InitializeAsync(JsonRpcMessage message, CancellationToken cancellationToken)
at ModelContextProtocol.McpSessionHandler.SendRequestAsync(JsonRpcRequest request, CancellationToken cancellationToken)
at ModelContextProtocol.McpSession.SendRequestAsync[TParameters,TResult](String method, TParameters parameters, JsonTypeInfo`1 parametersTypeInfo, JsonTypeInfo`1 resultTypeInfo, RequestId requestId, CancellationToken cancellationToken)
at ModelContextProtocol.Client.McpClientImpl.ConnectAsync(CancellationToken cancellationToken)
at ModelContextProtocol.Client.McpClientImpl.ConnectAsync(CancellationToken cancellationToken)
at ModelContextProtocol.Client.McpClient.CreateAsync(IClientTransport clientTransport, McpClientOptions clientOptions, ILoggerFactory loggerFactory, CancellationToken cancellationToken)
at ModelContextProtocol.Client.McpClient.CreateAsync(IClientTransport clientTransport, McpClientOptions clientOptions, ILoggerFactory loggerFactory, CancellationToken cancellationToken)
- Dominant language
- C#
- Stars
- 4.5k
- Forks
- 814
- Avg merge
- 9d 19h
- Merged PRs (30d)
- 4
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from modelcontextprotocol/csharp-sdk
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
modelcontextprotocol/csharp-sdk#1867 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
modelcontextprotocol/csharp-sdk#1840 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
modelcontextprotocol/csharp-sdk#1836 ·
-
enhancement needs confirmation
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
modelcontextprotocol/csharp-sdk#678 · 1 comment ·
-
enhancement needs confirmation P3 ready for work
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
modelcontextprotocol/csharp-sdk#515 · 6 comments · 3 reactions ·
All issues in modelcontextprotocol/csharp-sdk
Similar issues
-
untriaged
Difficulty 1/5 Under an hour Newbie friendliness 88/100
dotnet/dotnet-api-docs#13095 ·
-
area-deployment area-integrations triage:bot-seen
Difficulty 2/5 Half a day Newbie friendliness 86/100
-
type/automation type/tech-debt
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 90/100
newrelic/newrelic-dotnet-agent#3850 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
LuckyPennySoftware/AutoMapper#4660 ·