[v2] requireBearerAuth: drop error="invalid_token" when no credentials were sent and resource_metadata is set (RFC 6750 §3.1)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 82/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- typescript
- 领域
- api, authentication
调研方向
在 packages/server 中，找到 requireBearerAuth 和 Express 适配器使用的共享 bearerAuthChallengeResponse；先阅读它们构造 challenge 的方式以及附近的测试。为缺少凭据且带有 resource_metadata 或 scope、缺少凭据且没有其他参数，以及令牌无效的情况添加或更新测试。完成标准是：第一种情况省略 invalid_token，第二种情况保留当前 challenge，且无效令牌的响应保持不变。
由索引模型根据 Issue 内容生成。
描述
What happened?
When a request has no Authorization header, requireBearerAuth answers:
WWW-Authenticate: Bearer error="invalid_token", error_description="Missing Authorization header", scope="a:read", resource_metadata="https://mcp.example/.well-known/oauth-protected-resource/mcp"
RFC 6750 §3.1 says that when a request has no authentication information, the server SHOULD NOT include an error code.
This was tried in #785 (v1) and closed. The blocker there was §3: a Bearer challenge MUST carry at least one auth-param, so removing the error code meant adding a realm, which didn't fit.
That's different for MCP servers now. resource_metadata (RFC 9728) is the param MCP clients need to start sign-in, and the SDK already adds it when resourceMetadataUrl is set (and scope when requiredScopes is set).
Why it matters: the first request from every MCP client has no token, so this is the challenge every client sees first. invalid_token says "your token went bad" to a client that hasn't signed in yet. We ran into this building the MCP server for Bachs (a payments API), and write the challenge ourselves for now.
Would you take a PR for this? It's a small change plus tests in packages/server (the Express adapter shares bearerAuthChallengeResponse, so it would follow), and a v1.x backport if you want one.
What did you expect?
Drop the error code only when another param remains:
- no credentials, resource_metadata or scope present → Bearer scope="a:read", resource_metadata="…"
- no credentials, no other params → unchanged, so the challenge is never a bare "Bearer"
- a token was sent but is bad → unchanged
Code to reproduce
import { requireBearerAuth } from '@modelcontextprotocol/server';
const gate = requireBearerAuth({
verifier: { verifyAccessToken: async () => { throw new Error('unused'); } },
requiredScopes: ['a:read'],
resourceMetadataUrl: 'https://mcp.example/.well-known/oauth-protected-resource/mcp',
});
const res = await gate(new Request('https://mcp.example/mcp', { method: 'POST' }));
console.log(res.status, res.headers.get('www-authenticate'));
SDK version
@modelcontextprotocol/server 2.4.0
Area
Auth
- 主要语言
- TypeScript
- 星标
- 13.7k
- 派生
- 2.3k
- 平均合并
- 1 天 5 小时
- 30 天内合并 PR
- 51
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
modelcontextprotocol/typescript-sdk 的其他 Issue
-
The `maxToolInputElements` refusal lacks the `Input validation error:` prefix that the schema refusal carries可能已有人在做 @barry166 于 3 天前认领。 未关闭v1 v2
难度 2/5 1-3 小时 新手友好度 78/100
modelcontextprotocol/typescript-sdk#3111 · 3 条评论 ·
维护者通常 1 天内回复
-
server: registeredResource.update and registeredResourceTemplate.update desync title and metadata.title when updating metadata alone可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭v1 v2
难度 2/5 1-3 小时 新手友好度 76/100
modelcontextprotocol/typescript-sdk#3103 · 5 条评论 ·
维护者通常 1 天内回复
-
[v1.x] Protocol.request keeps its abort listener after the request resolved, so a later abort sends notifications/cancelled for an answered request (1.30.0)可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭v1
难度 2/5 1-3 小时 新手友好度 76/100
modelcontextprotocol/typescript-sdk#3090 · 2 条评论 ·
维护者通常 1 天内回复
-
[v2] e2e `protocol:timeout:max-total` is flaky over SSE: fake timers advance before the request reaches the server可能已有人在做 @Singmin 于 12 天前认领。 未关闭v1 v2
难度 2/5 1-3 小时 新手友好度 72/100
modelcontextprotocol/typescript-sdk#3045 ·
维护者通常 1 天内回复
-
[v1.x] Backport #2654: `notifications/cancelled` with `requestId: 0` is ignored, so the first server→client request cannot be cancelled (still in 1.32.1)可能已有人在做 @CloudCorpRecords 于 13 天前认领。 未关闭v1
难度 2/5 1-3 小时 新手友好度 77/100
modelcontextprotocol/typescript-sdk#3043 · 2 条评论 ·
维护者通常 1 天内回复
查看 modelcontextprotocol/typescript-sdk 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 85/100
Automattic/data-liberation-agent#1115 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复
-
CSS enhancement good first issue
难度 2/5 1-3 小时 新手友好度 70/100
pychess/pychess-variants#2448 ·
维护者通常 1 天内回复
-
[architect] Stale planning/scratch files at repo root (COMPONENT_SPLIT_SUMMARY.md etc.) describe already-completed work可能已有人在做 @hivecommons-hive 今天认领。 未关闭agent/architect architecture help wanted stage/040-covered-by-pr tech-debt
难度 2/5 1-3 小时 新手友好度 85/100
kubestellar/console#24716 ·
维护者通常 1 天内回复
-
helm-knative-apply.sh fails with Helm 4可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭area: triage theme: undefined
难度 2/5 1-3 小时 新手友好度 85/100
jhipster/generator-jhipster#35895 ·
维护者通常 1 天内回复