mcp_oauth_server example can not be tested in mcp inspector v0.13 #217

Activity

1. yexuanyang

   changed the title [-]Auth Headers is too old?[/-] [+]mcp_oauth_server example can not be tested in mcp inspector v0.13[/+] on May 25, 2025
2. yexuanyang commented on May 25, 2025

   

   yexuanyang

   on May 25, 2025

   ContributorAuthor

   More actions

   I compare the request headers sent by inspector in python example with rust example, hope these data can help.

   Request headers in python example:

   GET /.well-known/oauth-authorization-server HTTP/1.1
   Accept: */*
   Accept-Encoding: gzip, deflate, br, zstd
   Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
   Cache-Control: no-cache
   Connection: keep-alive
   Host: 127.0.0.1:8000
   MCP-Protocol-Version: 2025-03-26
   Origin: http://127.0.0.1:6274
   Pragma: no-cache
   Referer: http://127.0.0.1:6274/
   Sec-Fetch-Dest: empty
   Sec-Fetch-Mode: cors
   Sec-Fetch-Site: same-site
   User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0
   sec-ch-ua: "Chromium";v="136", "Microsoft Edge";v="136", "Not.A/Brand";v="99"
   sec-ch-ua-mobile: ?0
   sec-ch-ua-platform: "Windows"
   

   Request headers in rust example:

   GET /.well-known/oauth-authorization-server HTTP/1.1
   Accept: */*
   Accept-Encoding: gzip, deflate, br, zstd
   Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
   Cache-Control: no-cache
   Connection: keep-alive
   Host: 127.0.0.1:3000
   Origin: http://127.0.0.1:6274
   Pragma: no-cache
   Referer: http://127.0.0.1:6274/
   Sec-Fetch-Dest: empty
   Sec-Fetch-Mode: cors
   Sec-Fetch-Site: same-site
   User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0
   sec-ch-ua: "Chromium";v="136", "Microsoft Edge";v="136", "Not.A/Brand";v="99"
   sec-ch-ua-mobile: ?0
   sec-ch-ua-platform: "Windows"
   
3. yexuanyang commented on May 25, 2025

   

   yexuanyang

   on May 25, 2025

   ContributorAuthor

   More actions

   I think I found the problem, there is a cors_middleware in python example, looks like:

   # Create routes
       # Allow CORS requests for endpoints meant to be hit by the OAuth client
       # (with the client secret). This is intended to support things like MCP Inspector,
       # where the client runs in a web browser.
       routes = [
           Route(
               "/.well-known/oauth-authorization-server",
               endpoint=cors_middleware(
                   MetadataHandler(metadata).handle,
                   ["GET", "OPTIONS"],
               ),
               methods=["GET", "OPTIONS"],
           ),

   source link here: https://github.com/modelcontextprotocol/python-sdk/blob/f2f4dbdcbd30fd00ced777fd1f59d00624362c97/src/mcp/server/auth/routes.py#L88-L99

   And there is not a CORS middleware in rust example.

   I also check the preflight OPTIONS request in my browser, rust example response do not have Allow-Cross-Control-* headers, but python example does have.

   here are respose headers:

   Rust example:

   HTTP/1.1 200 OK
   content-type: application/json
   content-length: 277
   date: Sun, 25 May 2025 11:42:57 GMT
   

   Python example:

   HTTP/1.1 200 OK
   date: Sun, 25 May 2025 11:42:14 GMT
   server: uvicorn
   access-control-allow-origin: *
   access-control-allow-methods: GET, OPTIONS
   access-control-max-age: 600
   access-control-allow-headers: Accept, Accept-Language, Content-Language, Content-Type, mcp-protocol-version
   content-length: 2
   content-type: text/plain; charset=utf-8
   

   I think it is the key
4. yexuanyang commented on May 25, 2025

   

   yexuanyang

   on May 25, 2025

   ContributorAuthor

   More actions

   I have fixed this problem, I will create a pull request.
5. 4t145

   assigned

   jokemanfire

   on May 25, 2025
6. jokemanfire commented on May 26, 2025

   

   jokemanfire

   on May 26, 2025

   Member

   More actions

   I think it has been resolved.
7. jokemanfire

   closed this as completedon May 26, 2025