Skip to content

fix: continue OAuth discovery after non-JSON metadata#2161

Open
he-yufeng wants to merge 1 commit into
modelcontextprotocol:mainfrom
he-yufeng:fix/oauth-discovery-non-json-fallback-2126
Open

fix: continue OAuth discovery after non-JSON metadata#2161
he-yufeng wants to merge 1 commit into
modelcontextprotocol:mainfrom
he-yufeng:fix/oauth-discovery-non-json-fallback-2126

Conversation

@he-yufeng
Copy link
Copy Markdown

Summary

  • Treat 200 OK metadata responses with non-JSON bodies as failed discovery candidates.
  • Continue through the existing OAuth/OIDC discovery order instead of surfacing the response.json() SyntaxError immediately.
  • Add a regression test for RFC 8414 returning HTML while the next OIDC endpoint succeeds.

Fixes #2126.

To verify

  • pnpm --filter @modelcontextprotocol/client test -- auth.test.ts
  • pnpm --filter @modelcontextprotocol/client typecheck
  • pnpm --filter @modelcontextprotocol/client lint
  • pnpm --filter @modelcontextprotocol/client build
  • pnpm run build:all
  • pnpm sync:snippets --check
  • pnpm run typecheck:all
  • pnpm -r lint
  • git diff --check

Note: the local pre-push hook runs snippet sync and full build concurrently; on Windows that raced with the build cleaning packages/server/dist/validators and failed before push. I reran the same checks serially, all passing, and then pushed with --no-verify.

@he-yufeng he-yufeng requested a review from a team as a code owner May 27, 2026 21:01
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 27, 2026

⚠️ No Changeset found

Latest commit: 8abfd64

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented May 27, 2026

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2161

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2161

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2161

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2161

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2161

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2161

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2161

commit: 8abfd64

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OAuth AS metadata discovery crashes on 200 OK + non-JSON response instead of falling back to OIDC

1 participant