fix(auth): only strip trailing slash on root OAuth identifiers

Keep path-based issuer/resource/authorization_server identifiers intact
so exact-string matching still works. Root URLs still drop the synthetic
slash added by AnyHttpUrl.

Author: piyushbag

src/mcp/server/auth/routes.py

@@ -47,6 +47,19 @@ def validate_issuer_url(url: AnyHttpUrl):
 REGISTRATION_PATH = "/register"
 REVOCATION_PATH = "/revoke"
 
+
+def _metadata_identifier_url(url: AnyHttpUrl) -> str:
+    """Canonical wire form for issuer/resource identifiers in OAuth metadata.
+
+    Bare ``AnyHttpUrl("https://host")`` synthesizes a trailing slash. Strip that
+    only for root URLs (path ``""`` or ``"/"``) so RFC 8414/9728 exact string
+    comparison works. Path-based identifiers keep a trailing slash if present.
+    """
+    s = str(url)
+    if urlparse(s).path in ("", "/"):
+        return s.rstrip("/")
+    return s
+
 # SEP-990: leg 2 uses the RFC 7523 jwt-bearer grant; support is advertised as the ID-JAG profile.
 ID_JAG_GRANT_PROFILE = "urn:ietf:params:oauth:grant-profile:id-jag"
 
@@ -169,7 +182,7 @@ def build_metadata(
 
     # Create metadata
     metadata = OAuthMetadata(
-        issuer=cast(AnyHttpUrl, str(issuer_url).rstrip("/")),
+        issuer=cast(AnyHttpUrl, _metadata_identifier_url(issuer_url)),
         authorization_endpoint=authorization_url,
         token_endpoint=token_url,
         scopes_supported=client_registration_options.valid_scopes,
@@ -237,10 +250,10 @@ def create_protected_resource_routes(
         List of Starlette routes for protected resource metadata
     """
     metadata = ProtectedResourceMetadata(
-        resource=cast(AnyHttpUrl, str(resource_url).rstrip("/")),
+        resource=cast(AnyHttpUrl, _metadata_identifier_url(resource_url)),
         authorization_servers=cast(
             list[AnyHttpUrl],
-            [str(server).rstrip("/") for server in authorization_servers],
+            [_metadata_identifier_url(server) for server in authorization_servers],
         ),
         scopes_supported=scopes_supported,
         resource_name=resource_name,

tests/server/auth/test_protected_resource.py

@@ -150,6 +150,24 @@ def test_metadata_url_construction_various_resource_configurations(resource_url:
 # Tests for consistency between URL generation and route registration
 
 
+@pytest.mark.anyio
+async def test_path_based_identifiers_keep_trailing_slash():
+    """Path-based resource/AS identifiers keep a configured trailing slash."""
+    routes = create_protected_resource_routes(
+        resource_url=AnyHttpUrl("https://rs.example.com/mcp/"),
+        authorization_servers=[AnyHttpUrl("https://as.example.com/realms/foo/")],
+    )
+    app = Starlette(routes=routes)
+    async with httpx2.AsyncClient(
+        transport=httpx2.ASGITransport(app=app), base_url="https://rs.example.com"
+    ) as client:
+        response = await client.get("/.well-known/oauth-protected-resource/mcp/")
+        assert response.status_code == 200
+        body = response.json()
+        assert body["resource"] == "https://rs.example.com/mcp/"
+        assert body["authorization_servers"] == ["https://as.example.com/realms/foo/"]
+
+
 def test_route_consistency_route_path_matches_metadata_url():
     """Test that route path matches the generated metadata URL."""
     resource_url = AnyHttpUrl("https://example.com/mcp")

tests/server/auth/test_routes.py

@@ -81,3 +81,15 @@ def test_build_metadata_strips_trailing_slash_from_anyhttpurl_issuer():
 
     served = metadata.model_dump(mode="json", exclude_none=True)
     assert served["issuer"] == "http://localhost:8000"
+
+
+def test_build_metadata_preserves_trailing_slash_on_path_issuer():
+    """Path-based issuer identifiers keep a configured trailing slash (exact-string match)."""
+    issuer_url = AnyHttpUrl("https://as.example.com/tenant/")
+    assert str(issuer_url).endswith("/tenant/")
+
+    metadata = build_metadata(issuer_url, None, ClientRegistrationOptions(), RevocationOptions())
+
+    served = metadata.model_dump(mode="json", exclude_none=True)
+    assert served["issuer"] == "https://as.example.com/tenant/"
+    assert served["authorization_endpoint"] == "https://as.example.com/tenant/authorize"