Pin RFC 8414 Default Well-Known Suffix per SEP-2351#395
Open
koic wants to merge 1 commit into
Open
Conversation
## Motivation and Context SEP-2351 (modelcontextprotocol/modelcontextprotocol#2351, merged for the 2026-07-28 spec release) makes explicit that MCP uses the default `oauth-authorization-server` well-known URI suffix from RFC 8414 Section 3.1 and defines no application-specific suffix. `MCP::Client::OAuth::Discovery.authorization_server_metadata_urls` already conforms: it probes the RFC 8414 default suffix first (path-inserted form for path issuers) and otherwise uses only the OpenID Connect Discovery `openid-configuration` suffix. Neither the Python SDK nor the TypeScript SDK needed a behavior change for this SEP either; their tracking issues (python-sdk#2799, typescript-sdk#2256) remain documentation-level. This change documents the SEP-2351 guarantee in the discovery helper and locks the behavior in with regression tests so a future refactor cannot silently introduce a non-default suffix. Resolves modelcontextprotocol#384. ## How Has This Been Tested? New regression tests in `test/mcp/client/oauth/discovery_test.rb`: - the first probed candidate for a root issuer is exactly `/.well-known/oauth-authorization-server` - every generated candidate uses only the `oauth-authorization-server` or `openid-configuration` suffix - the RFC 8414 path-inserted `oauth-authorization-server` candidate comes first for issuers with a path component - an issuer URL with a trailing slash is treated as a root issuer ## Breaking Changes None. Documentation and regression tests only; no behavior change.
d504755 to
2a26ad2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
SEP-2351 (modelcontextprotocol/modelcontextprotocol#2351, merged for the 2026-07-28 spec release) makes explicit that MCP uses the default
oauth-authorization-serverwell-known URI suffix from RFC 8414 Section 3.1 and defines no application-specific suffix.MCP::Client::OAuth::Discovery.authorization_server_metadata_urlsalready conforms: it probes the RFC 8414 default suffix first (path-inserted form for path issuers) and otherwise uses only the OpenID Connect Discoveryopenid-configurationsuffix. Neither the Python SDK nor the TypeScript SDK needed a behavior change for this SEP either; their tracking issues (python-sdk#2799, typescript-sdk#2256) remain documentation-level.This change documents the SEP-2351 guarantee in the discovery helper and locks the behavior in with regression tests so a future refactor cannot silently introduce a non-default suffix.
Resolves #384.
How Has This Been Tested?
New regression tests in
test/mcp/client/oauth/discovery_test.rb:/.well-known/oauth-authorization-serveroauth-authorization-serveroropenid-configurationsuffixoauth-authorization-servercandidate comes first for issuers with a path componentBreaking Changes
None. Documentation and regression tests only; no behavior change.
Types of changes
Checklist