pFad - Phone/Frame/Anonymizer/Declutterfier! Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

URL: http://github.com/modelcontextprotocol/python-sdk/pull/2645

com/assets/actions-9111c292f95f2fb0.css" /> fix(oauth): omit resource param on token refresh by Epochex · Pull Request #2645 · modelcontextprotocol/python-sdk · GitHub
Skip to content

fix(oauth): omit resource param on token refresh#2645

Open
Epochex wants to merge 4 commits into
modelcontextprotocol:mainfrom
Epochex:fix/oauth-refresh-resource-param
Open

fix(oauth): omit resource param on token refresh#2645
Epochex wants to merge 4 commits into
modelcontextprotocol:mainfrom
Epochex:fix/oauth-refresh-resource-param

Conversation

@Epochex
Copy link
Copy Markdown

@Epochex Epochex commented May 19, 2026

Fixes #2578.

Entra ID v2.0 rejects RFC 8707
esource on refresh token requests, and Pydantic AnyHttpUrl normalizes bare-domain URLs with a trailing slash.

Changes:

  • Strip the trailing slash when deriving the RFC8707 resource from PRM metadata.
  • Do not include
    esource in
    efresh_token grant requests.

Tests:

  • uv run --frozen pytest tests/client/test_auth.py -k get_resource_url_strips_trailing_slash_from_bare_domain_prm
  • uv run --frozen pytest tests/client/test_auth.py -k refresh_token_request_omits_resource_even_when_required_by_protocol
  • uv run --frozen python -m ruff check src/mcp/client/auth/oauth2.py tests/client/test_auth.py
  • uv run --frozen python -m ruff format src/mcp/client/auth/oauth2.py tests/client/test_auth.py

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

OAuth token refresh sends RFC 8707 resource parameter that Entra ID v2.0 rejects (AADSTS9010010)

1 participant

@Epochex
pFad - Phonifier reborn

Pfad - The Proxy pFad © 2024 Your Company Name. All rights reserved.




Check this box to remove all script contents from the fetched content.



Check this box to remove all images from the fetched content.


Check this box to remove all CSS styles from the fetched content.


Check this box to keep images inefficiently compressed and original size.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy