René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"`OAuthClientInformationFull.redirect_uris`: pydantic strict-type-equality breaks `AnyUrl(x) != AnyHttpUrl(x)` round-trip","articleBody":"Summary\nWhen implementing a custom OAuth provider against the MCP Python SDK, callers must construct `OAuthClientInformationFull` instances. The SDK declares `redirect_uris: list[AnyUrl]` (where `AnyUrl` is pydantic's base URL type). Passing pydantic's stricter subtype `AnyHttpUrl` (or any other AnyUrl subtype) causes silent equality failures downstream: `AnyUrl(\"https://...\") == AnyHttpUrl(\"https://...\")` returns `False` in pydantic v2, even when the two URLs serialize identically. This breaks `redirect_uri` matching during the `/authorize` → `/token` exchange.\nReproducer\n```python\nfrom pydantic import AnyUrl, AnyHttpUrl\nfrom mcp.server.auth.provider import OAuthClientInformationFull\n\n# pydantic v2 strict-type equality\nu1 = AnyUrl(\"https://example.com/callback\")\nu2 = AnyHttpUrl(\"https://example.com/callback\")\nassert str(u1) == str(u2)   # True (both render the same)\nassert u1 == u2              # FAILS in pydantic v2 — different runtime types\n\n# Concrete impact in OAuth flow:\nclient_info = OAuthClientInformationFull(\n    client_id=\"test\",\n    redirect_uris=[AnyHttpUrl(\"https://example.com/cb\")],\n    # ...other required fields\n)\n# When the /authorize request arrives with redirect_uri parameter, the SDK\n# constructs an AnyUrl from the query string and checks membership:\nincoming = AnyUrl(\"https://example.com/cb\")\nassert incoming in client_info.redirect_uris   # FAILS — type mismatch\n```\nExpected behavior\n`OAuthClientInformationFull.redirect_uris` should accept and compare-equal across AnyUrl and AnyUrl subtypes (AnyHttpUrl, AnyHttpsUrl, etc.) when the underlying URL is identical.\nActual behavior\nStrict-type equality causes the membership check to fail. The OAuth flow returns a generic redirect-mismatch error to the client; the underlying cause (type vs URL mismatch) is invisible without instrumenting the SDK.\nSuggested fix\nTwo options:\nCoerce on assignment. Have `OAuthClientInformationFull.redirect_uris` field validator coerce all values to `AnyUrl` (the declared base type), regardless of what the caller passes. This is the cleanest fix and matches the field declaration.\nCompare-by-string. Override `__eq__` on the AnyUrl chain to compare-by-`str()` rather than by runtime type. Broader-impact change; probably not desirable.\nOption 1 is preferred. A short field_validator with `mode=\"before\"` converting to `AnyUrl` strings before pydantic instantiates would do it.\nWorkaround (current PolyBot mitigation)\nPass `redirect_uris` as raw `list[str]`; pydantic coerces to `AnyUrl` per the field declaration. This avoids the type mismatch:\n```python\nclient_info = OAuthClientInformationFull(\n    client_id=\"test\",\n    redirect_uris=[\"https://example.com/cb\"],   # raw strings, not AnyHttpUrl\n    # ...\n)\n```\nWorks at runtime; loses some IDE type hints in the caller code.\nEnvironment\nmcp Python SDK version: 1.27.1\npydantic version: 2.x\nPython: 3.11+\nRelated code locations\nIn the MCP SDK:\n`mcp/server/auth/provider.py` — `OAuthClientInformationFull` definition with `redirect_uris: list[AnyUrl]`\n`mcp/server/auth/handlers/authorize.py` — where the membership check happens\nSeverity\nMedium — silently breaks OAuth flows in custom-provider setups; reproducer is simple; workaround is trivial once known but the failure mode is hard to diagnose from the user-facing error.","author":{"url":"https://github.com/ptrhrsch-arch","@type":"Person","name":"ptrhrsch-arch"},"datePublished":"2026-05-26T10:37:28.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":4},"url":"https://github.com/2687/python-sdk/issues/2687"}