fix(auth): ignore query parameters in protected resource matching - #1177
Open
stevenlee-oai wants to merge 1 commit into
Open
Conversation
github-actions
Bot
added
T-core
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The AWS MCP Server exposes both public documentation tools and authenticated AWS API tools. Requiring OAuth during every initialization would block public tools, but some clients only start OAuth after an initialization-time
401. AWS therefore uses?oauth=initializeto request an earlyWWW-Authenticatechallenge without changing the token audience:MCP permits authorization-dependent tool visibility and documents 401 discovery and step-up authorization, but does not prescribe first-time OAuth negotiation for endpoints mixing public and protected tools.
Standards and compatibility
RFC 8707 §2 says resource URIs SHOULD NOT contain queries, but explicitly permits them; it prohibits fragments and does not define query equivalence. RFC 9728 §3.3 requires exact metadata matching, which literally rejects this AWS pattern. The TypeScript SDK resolves that interoperability tension by comparing origin and path while ignoring queries.
This PR adopts the same policy: preserve scheme, host, port, path-boundary, and fragment checks; ignore queries for equal or permitted parent paths; and use the metadata's canonical resource in OAuth requests. Consequently, queries no longer distinguish same-origin, path-compatible resources.
Validation
cargo +1.97.1 test -p rmcp --features auth,transport-io cargo +nightly-2025-09-01 fmt --all -- --check git diff --check554 tests pass, including 369 library tests. Coverage includes the AWS-style OAuth flow, absent/differing queries, parent paths, deceptive path prefixes, and cross-origin resources; the new regression fails before the fix.