Skip to content

Feat: Separate authorization server and resource server on client auth flow #416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Open

Feat: Separate authorization server and resource server on client auth flow #416

wants to merge 9 commits into from

Conversation

0Itsuki0
Copy link

@0Itsuki0 0Itsuki0 commented Apr 27, 2025 •
edited
Loading

Conform to the new authentication protocol by separating authorization server and resource server.

  • add function to discover protected resource metadata
  • use the discovered authorization server url for the auth flow

Motivation and Context

Ensure the sdk functionality conforms to the protocol specification.

How Has This Been Tested?

npm test

  • Modifying Existing tests to make sure they all past
  • Add couple new tests for the authorization-related functions

Breaking Changes

Yes.

  1. The functions arguments in auth.ts other than the auth() function requires authorization server url instead of resource server url.
  2. The flow requires the server to implement OAuth 2.0 Protected Resource Metadata as specified in the authorization section of the protocol.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

None.

@0Itsuki0 0Itsuki0 marked this pull request as ready for review April 27, 2025 10:25
@0Itsuki0 0Itsuki0 changed the title Separate authorization server and resource server on client auth flow Feat: Separate authorization server and resource server on client auth flow Apr 28, 2025
@QuantGeekDev
Copy link

Looking quite good. Thanks for the blog post on this. I'm going to test this out

@QuantGeekDev
Copy link

Code also looks good

@0Itsuki0
Copy link
Author

0Itsuki0 commented May 7, 2025

Code also looks good

Thank you!

The spec seems to be still under construction, especially the toke validation parts. I am willing to add more if necessary but probably at a different branch would be better?

@QuantGeekDev
Copy link

@0Itsuki0 I built a mcp server with the latest draft of the spec - maybe we can try the client against this? I've been testing with my postman collection so far

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@0Itsuki0 @QuantGeekDev