Bearer challenge points resource_metadata to a 404 when resourceUri has a path
Maintainers usually reply within 1 day
A pull request for this has already been merged.
- #232 by @mcollina — merged
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
- Domain
- authentication
Research direction
Read src/auth/prehandler.ts and src/routes/well-known.ts to trace how the challenge URL and metadata resource are built. Use the reproduction with resourceUri: 'https://mcp.example.com/mcp' to verify the behavior; done means the metadata URL follows RFC 9728 §3.1 and the advertised resource exactly matches resourceUri.
Written by the indexing model from the issue text.
Description
When authorization.resourceUri includes a path (for example https://mcp.example.com/mcp, which authorization.md lists as a valid canonical URI), protected-resource discovery breaks:
src/auth/prehandler.tsbuilds the 401 challenge asresource_metadata="${resourceUri}/.well-known/oauth-protected-resource". That giveshttps://mcp.example.com/mcp/.well-known/oauth-protected-resource, which returns 404.src/routes/well-known.tsonly serves/.well-known/oauth-protected-resourceand/.well-known/oauth-protected-resource/mcp. The/mcpvariant appends/mcpagain and advertisesresource: "https://mcp.example.com/mcp/mcp".
Expected (RFC 9728 §3.1): the metadata URL is the origin plus /.well-known/oauth-protected-resource plus the resource path, and the advertised resource equals resourceUri exactly.
Repro: configure resourceUri: 'https://mcp.example.com/mcp', send an unauthenticated request to /mcp, then fetch the URL in the resource_metadata parameter. The fetch returns 404.
Found while reviewing #170. Already present on main.
- Dominant language
- TypeScript
- Stars
- 58
- Forks
- 15
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 54
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from platformatic/mcp
-
Legacy POST accepts messages that are not JSON-RPC 2.0Possibly taken @mcollina claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
platformatic/mcp#344 ·
Maintainers usually reply within 1 day
-
Legacy SSE GET ignores resolveAuthorizationContext expiresAtPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
platformatic/mcp#336 ·
Maintainers usually reply within 1 day
-
Legacy SSE GET drops headers set by hooks (CORS, security headers)Possibly taken @mcollina claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
platformatic/mcp#335 ·
Maintainers usually reply within 1 day
-
Disconnecting during a Last-Event-ID replay leaves a dead SSE stream and the session answers 409 foreverPossibly taken @mcollina claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
platformatic/mcp#334 ·
Maintainers usually reply within 1 day
-
tasks/result leaves a waiter behind forever when its client has already disconnectedPossibly taken @mcollina claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
platformatic/mcp#333 ·
Maintainers usually reply within 1 day
All issues in platformatic/mcp
Similar issues
-
Area/Cloud Needs Triage Type/Bug
Difficulty 1/5 1-3 hours Newbie friendliness 86/100
wso2/product-integrator#2847 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
bluesky-social/social-app#12118 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 1/5 Under an hour Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
heygen-com/hyperframes#6021 ·
Maintainers usually reply within 1 day
-
check:passed streams:edit
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day