Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

OAuth token expiry equality boundary causes intermittent downstream test failures

未关闭 适合新手
  • 哪里不对？
#3,729 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

  • #3730 来自 @pei711 —— 已关闭，未合并

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
74/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
python
领域
authentication, backend

调研方向

先阅读 mcp/client/auth/oauth2.py 中的 OAuthContext.is_token_valid() 和 update_token_expiry()，然后检查令牌过期测试。使用提供的固定时钟示例复现相等边界。完成标准是：令牌在其过期时间戳时无效，并且测试覆盖相等的情况以及刚过期后的时间点。

由索引模型根据 Issue 内容生成。

描述

bug v1 v2
Initial Checks
Release line

2.x (current stable)

Description

While running FastMCP's stored-token expiry tests on Windows, I observed intermittent failures with expires_in=0: the client sometimes reused the stored token instead of acquiring a fresh one.

I reproduced the behavior in isolated environments using MCP SDK 2.3.0 alone and FastMCP 4.1.1 with MCP SDK 2.3.0.

OAuthContext.is_token_valid() returns True when the current time exactly equals token_expiry_time, because it uses <=. Once the clock advances past that timestamp, it correctly returns False. The same equality behavior occurs with a normal 3600-second token checked exactly at expiry.

I expected the token to be invalid at its expiration timestamp. Could you confirm whether the inclusive boundary is intentional, or whether it should be considered expired at equality?

The observed impact is intermittent downstream test failures, not a demonstrated production authentication failure. The example below uses a fixed nonzero clock to make the boundary deterministic; it needs no network or real credentials.

Prepared with AI assistance; the reproductions were executed locally and reviewed before submission.

Example Code
from unittest.mock import Mock, patch

from mcp.client.auth.oauth2 import OAuthContext, TokenStorage
from mcp.shared.auth import OAuthClientMetadata, OAuthToken

context = OAuthContext(
    server_url="https://mcp.example.test/mcp",
    client_metadata=OAuthClientMetadata(
        redirect_uris=["http://localhost/callback"]
    ),
    storage=Mock(spec=TokenStorage),
    redirect_handler=None,
    callback_handler=None,
)

with patch("time.time", return_value=1_800_000_000.0):
    token = OAuthToken(
        access_token="example-token",
        token_type="Bearer",
        expires_in=0,
    )
    context.current_tokens = token
    context.update_token_expiry(token)
    print("At expiry:", context.is_token_valid())  # True

with patch("time.time", return_value=1_800_000_000.001):
    print("After expiry:", context.is_token_valid())  # False
Python & MCP Python SDK
Windows
Python 3.12.15
MCP SDK 2.3.0
Pydantic 2.14.1

Also reproduced through FastMCP 4.1.1's client-credentials auth flow
with MCP SDK 2.3.0 in a separate environment.
主要语言
Python
星标
24.6k
派生
4.2k
平均合并
10 小时 37 分钟
30 天内合并 PR
38

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

modelcontextprotocol/python-sdk 的其他 Issue

查看 modelcontextprotocol/python-sdk 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。