Skip to content

fix: compare OAuth redirect URI strings#2825

Open
sarvesh1327 wants to merge 1 commit into
modelcontextprotocol:mainfrom
sarvesh1327:fix/oauth-redirect-uri-canonicalization
Open

fix: compare OAuth redirect URI strings#2825
sarvesh1327 wants to merge 1 commit into
modelcontextprotocol:mainfrom
sarvesh1327:fix/oauth-redirect-uri-canonicalization

Conversation

@sarvesh1327

Copy link
Copy Markdown

Summary

  • Compare OAuth redirect URIs by their serialized URL value instead of Pydantic URL object equality.
  • Adds regressions for registered AnyHttpUrl values being validated against incoming AnyUrl values, while still rejecting unregistered redirects.

Fixes #2687

Test Plan

  • uv run --frozen pytest tests/shared/test_auth.py -q
  • uv run --frozen ruff check src/mcp/shared/auth.py tests/shared/test_auth.py
  • uv run --frozen ruff format --check src/mcp/shared/auth.py tests/shared/test_auth.py
  • uv run --frozen coverage combine && uv run --frozen coverage report --include='src/mcp/shared/auth.py' --fail-under=0
  • UV_FROZEN=1 uv run --frozen strict-no-cover

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OAuthClientInformationFull.redirect_uris: pydantic strict-type-equality breaks AnyUrl(x) != AnyHttpUrl(x) round-trip

1 participant