Skip to content

fix: continue auth discovery after invalid JSON metadata#2140

Open
he-yufeng wants to merge 1 commit into
modelcontextprotocol:mainfrom
he-yufeng:fix/oauth-metadata-non-json-fallback
Open

fix: continue auth discovery after invalid JSON metadata#2140
he-yufeng wants to merge 1 commit into
modelcontextprotocol:mainfrom
he-yufeng:fix/oauth-metadata-non-json-fallback

Conversation

@he-yufeng
Copy link
Copy Markdown

Summary

  • treat a 200 response with invalid JSON as a failed authorization metadata endpoint
  • continue walking the RFC 8414 / OIDC discovery URL list instead of surfacing a terminal SyntaxError
  • add a regression test for path-based auth server discovery falling through to OIDC metadata

Fixes #2126

To verify

  • pnpm --filter @modelcontextprotocol/client exec vitest run test/client/auth.test.ts
  • pnpm --filter @modelcontextprotocol/client run typecheck
  • pnpm --filter @modelcontextprotocol/client run lint
  • pnpm --filter @modelcontextprotocol/client run build
  • git diff --check
  • pre-push hook also ran build:all, typecheck:all, and lint:all

@he-yufeng he-yufeng requested a review from a team as a code owner May 21, 2026 11:48
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 21, 2026

🦋 Changeset detected

Latest commit: 013ebcb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@modelcontextprotocol/client Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented May 21, 2026

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2140

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2140

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2140

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2140

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2140

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2140

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2140

commit: 013ebcb

@he-yufeng he-yufeng force-pushed the fix/oauth-metadata-non-json-fallback branch from edf4850 to c3af4a1 Compare May 24, 2026 07:16
@he-yufeng he-yufeng force-pushed the fix/oauth-metadata-non-json-fallback branch from c3af4a1 to 013ebcb Compare May 27, 2026 10:39
@he-yufeng
Copy link
Copy Markdown
Author

Added the client patch changeset and force-pushed 013ebcb. Local validation: changeset status shows @modelcontextprotocol/client patch; client auth.test.ts passed with 168 tests; client typecheck and lint passed; git diff --check passed. Pre-push typecheck, build, and lint also passed.

@he-yufeng
Copy link
Copy Markdown
Author

I checked the remaining red job. The failed shard is test/server/cloudflareWorkers.test.ts and the failure is a Miniflare network disconnect while POSTing to the endpoint. This PR only touches the client OAuth metadata fallback path plus its client auth tests, and build, client-conformance, server-conformance, pkg-publish, test (20), test (24), bun, and deno all passed. I don't see a PR-related action item from this failure.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OAuth AS metadata discovery crashes on 200 OK + non-JSON response instead of falling back to OIDC

1 participant