Title: Preserve empty issuer/resource paths on AuthSettings by Kludex · Pull Request #2987 · modelcontextprotocol/python-sdk · GitHub
Open Graph Title: Preserve empty issuer/resource paths on AuthSettings by Kludex · Pull Request #2987 · modelcontextprotocol/python-sdk
X Title: Preserve empty issuer/resource paths on AuthSettings by Kludex · Pull Request #2987 · modelcontextprotocol/python-sdk
Description: Summary AuthSettings.issuer_url and resource_server_url are typed AnyHttpUrl, which normalizes a path-less URL with a trailing slash before the model's config can apply. As a result the authorization server advertised issuer as https://as.example.com/ instead of https://as.example.com in its metadata — inconsistent with the exact string comparison RFC 8414 / RFC 9207 require for issuer matching. This applies url_preserve_empty_path=True to AuthSettings, the same fix #2925 made for the metadata models (OAuthMetadata, ProtectedResourceMetadata, OAuthClientMetadata). A string issuer_url/resource_server_url now keeps its canonical form end to end (config → build_metadata → served metadata). Why Surfaced while testing a real OAuth flow end to end: a client that discovers the issuer over the wire and uses it for issuer comparison (or as a token audience) saw .../ while the deployer's own constant had no slash, breaking the exact-match comparison the RFCs mandate. Behavior change Passing a string issuer/resource keeps the empty path (no trailing slash). Passing an already-built AnyHttpUrl object still normalizes at construction (unchanged) — pass a string to get the preserved form. Documented in docs/migration.md alongside the existing trailing-slash entry. AI Disclaimer This PR was developed with the assistance of either Claude or Codex. I've reviewed and verified the changes.
Open Graph Description: Summary AuthSettings.issuer_url and resource_server_url are typed AnyHttpUrl, which normalizes a path-less URL with a trailing slash before the model's config can apply. As a result the authori...
X Description: Summary AuthSettings.issuer_url and resource_server_url are typed AnyHttpUrl, which normalizes a path-less URL with a trailing slash before the model's config can apply. As a result the aut...
Opengraph URL: https://github.com/modelcontextprotocol/python-sdk/pull/2987
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:65ba3b2a-7fcb-0337-a5ac-248f47735ca5 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | B5EC:175F4A:1AADC78:260411D:6A5A3B02 |
| html-safe-nonce | 644f01f15b8ec35d925a17eb93dd904f30e8e8c6f3781380466338a656ff88d7 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJCNUVDOjE3NUY0QToxQUFEQzc4OjI2MDQxMUQ6NkE1QTNCMDIiLCJ2aXNpdG9yX2lkIjoiMjE1OTEyMDUyODY2NTM2MTE1NCIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | 32cb865cc41dc6779b229ae2f551eaec7a0f61105eff7f90fdb645769c9fcc42 |
| hovercard-subject-tag | pull_request:3941282911 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/modelcontextprotocol/python-sdk/pull/2987/files |
| twitter:image | https://avatars.githubusercontent.com/u/7353520?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/7353520?s=400&v=4 |
| og:image:alt | Summary AuthSettings.issuer_url and resource_server_url are typed AnyHttpUrl, which normalizes a path-less URL with a trailing slash before the model's config can apply. As a result the authori... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 19c67ad7579d2401ff06e88a32ef45460fbb40fab3191c7f7582d5e166f326fc |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/modelcontextprotocol/python-sdk git https://github.com/modelcontextprotocol/python-sdk.git |
| octolytics-dimension-user_id | 182288589 |
| octolytics-dimension-user_login | modelcontextprotocol |
| octolytics-dimension-repository_id | 862584018 |
| octolytics-dimension-repository_nwo | modelcontextprotocol/python-sdk |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 862584018 |
| octolytics-dimension-repository_network_root_nwo | modelcontextprotocol/python-sdk |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | e618485bff22dab2ef1ffb4e34e4e6626688df69 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width