auth/mcp: client DPoP support (SEP-1932 baseline, no nonce) - #1140
Open
gbshankar wants to merge 3 commits into
Open
auth/mcp: client DPoP support (SEP-1932 baseline, no nonce)#1140gbshankar wants to merge 3 commits into
gbshankar wants to merge 3 commits into
Conversation
Wire the everything-client to the DPoP baseline scenario with a hand-rolled OAuth + per-request proof path so CI stops expecting auth/dpop to fail. Nonce posture (auth/dpop-nonce) remains deferred; this is harness coverage, not SDK DPoP support. Co-authored-by: Cursor <cursoragent@cursor.com>
Add opt-in DPoP for AuthorizationCodeHandler and StreamableClientTransport: proof helpers in oauthex, token.Type() for the Authorization scheme, and an optional RequestPreparer hook for per-request proofs. Migrate the conformance auth/dpop client onto this path. Nonce handling remains out of scope (see modelcontextprotocol#1139). Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid scheme/proof split after refresh when AS token_type is empty or Bearer: the preparer sets Authorization and DPoP together from client DPoP mode instead of trusting token.Type(). Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stacked on / blocked by #1138 (harness). Design: #1139.
Adds real SDK baseline DPoP (RFC 9449 / SEP-1932) so apps can opt in via
AuthorizationCodeHandlerConfig.DPoP:oauthex: ES256 keypair, proof builder,ath, HTU helpers, RFC-vector tests (no nonce in the public API)mcp:Authorizationusestoken.Type(); optionalauth.RequestPreparertype-assert for per-requestDPoPproofs (non-breaking for existingOAuthHandlerimplementors)auth: opt-in DPoP on token exchange/refresh viaDPoPRoundTripper;AuthorizationCodeHandlerimplementsRequestPreparerauth/dpopeverything-client rewritten to use the SDK pathOut of scope:
auth/dpop-nonce, serverRequireDPoP, metadata auto-enable.Test plan
go test ./oauthex/ ./auth/ ./mcp/auth/dpop→ 12/12 via SDK pathbaseline.yml(auth/dpop-noncestill expected-fail)mainafter conformance: pass auth/dpop (SEP-1932 baseline) #1138 merges (this PR currently includes that commit)Made with Cursor