René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"_handle_refresh_response discards existing refresh_token when server omits it","articleBody":"### Initial Checks\n\n- [x] I confirm that I'm using the latest version of MCP Python SDK\n- [x] I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue\n\n### Description\n\n`_handle_refresh_response()` in `src/mcp/client/auth/oauth2.py` replaces the stored token object with the parsed refresh response as-is. When the authorization server does not return a new `refresh_token` in the refresh response, the previously stored `refresh_token` is lost. After the first successful refresh, `can_refresh_token()` returns `False` and all subsequent refreshes fail, forcing full re-authentication.\n\nPer [RFC 6749 Section 6](https://datatracker.ietf.org/doc/html/rfc6749#section-6), issuing a new refresh token in the refresh response is optional:\n\n\u003e \"The authorization server MAY issue a new refresh token, in which case the client MUST discard the old refresh token and replace it with the new refresh token.\"\n\nThe implicit corollary is that if the server does not issue a new refresh token, the client must preserve the existing one.\n\nMany OAuth providers omit the `refresh_token` from refresh responses by default (e.g., Google, Auth0 without rotation enabled, Okta in persistent token mode). This makes the current behavior a practical issue for a wide range of OAuth servers.\n\n### Current Code\n\n```python\nasync def _handle_refresh_response(self, response: httpx.Response) -\u003e bool:\n    ...\n    token_response = OAuthToken.model_validate_json(content)\n\n    self.context.current_tokens = token_response  # overwrites old refresh_token\n    self.context.update_token_expiry(token_response)\n    await self.context.storage.set_tokens(token_response)\n    ...\n```\n\n### Proposed Fix\n\nPreserve the existing `refresh_token` when the refresh response omits one:\n\n```python\ntoken_response = OAuthToken.model_validate_json(content)\n\n# Per RFC 6749 Section 6, the server MAY issue a new refresh token.\n# If the response omits it, preserve the existing one.\nif not token_response.refresh_token and self.context.current_tokens and self.context.current_tokens.refresh_token:\n    token_response = token_response.model_copy(\n        update={\"refresh_token\": self.context.current_tokens.refresh_token}\n    )\n\nself.context.current_tokens = token_response\n...\n```\n\n### Related Issues\n\n- #1318 - Critical Token Refresh Bugs (token expiry tracking, P1)\n- #1250 - Framework does not handle refreshed tokens correctly (P1)\n- PR #2039 - SEP-2207: Refresh token guidance (adds `offline_access` scope, does not address preservation)\n\n### Python \u0026 MCP Python SDK\n\n```Text\nv1.26.0\n```","author":{"url":"https://github.com/oedokumaci","@type":"Person","name":"oedokumaci"},"datePublished":"2026-03-11T13:59:01.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/2270/python-sdk/issues/2270"}