fix: match complete www-authenticate auth params

Closed
PR
2mo ago
+119-8

Fixes modelcontextprotocol/python-sdk#3009

Updates extract_field_from_www_auth so it only matches complete WWW-Authenticate auth-param names. This prevents fields like scope from matching inside longer names such as error_scope or custom_scope, and prevents resource_metadata from matching inside x_resource_metadata.

Motivation and Context

The previous regex searched for the field name without a boundary, so a decoy parameter could shadow the real auth-param value or return a value when the requested parameter was not present.

This matters for OAuth discovery because resource_metadata from WWW-Authenticate controls the protected resource metadata URL selection.

How Has This Been Tested?

Tested locally with:

python -m pytest tests/client/test_auth.py -k WWWAuthenticate
python -m ruff check src/mcp/client/auth/utils.py tests/client/test_auth.py
python -m ruff format --check src/mcp/client/auth/utils.py tests/client/test_auth.py

Scenarios covered:

  • error_scope before real scope
  • custom_scope without real scope
  • x_resource_metadata before real resource_metadata
  • x_resource_metadata without real resource_metadata

Breaking Changes

None.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

The fix escapes the requested field name and requires it to appear at the start of the header or after an auth-param separator, so only complete auth-param names are matched.