modelcontextprotocol / modelcontextprotocol/conformance

AS issuer validation failure

Open
#140 6 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
127
Forks
101
Avg merge
6d 1h
Merged PRs (30d)
7

Description

Describe the bug
I'm currently working on implementing client-side OAuth in Go SDK and I'm running into a conformance test failure which I'm not sure is warranted, so I would like to consult.

The issue is related to Authorization Server Metadata handling. In metadata-var2 and metadata-var3 tests, the authorization server's issuer identifier contains a non-empty path component /tenant1. According to RFC 8141 section 3.3 a client must validate if the issuer value returned by the authorization server is the same as the identifier used to create the URL for the metadata. However, the AS returns a value with no path component, for example:

 {
    "id": "outgoing-auth-response",
    "name": "Outgoing-auth-response",
    "description": "Sent 200 response for GET /.well-known/oauth-authorization-server/tenant1",
    "status": "INFO",
    "timestamp": "2026-02-10T14:02:08.022Z",
    "details": {
      "method": "GET",
      "path": "/.well-known/oauth-authorization-server/tenant1",
      "statusCode": 200,
      "headers": {
        "x-powered-by": "Express",
        "content-type": "application/json; charset=utf-8",
        "content-length": "417",
        "etag": "W/\"1a1-vdDFr5xugGjES09D01A3xMuA7xw\""
      },
      "body": {
        "issuer": "http://localhost:35909",  <--- HERE
        "authorization_endpoint": "http://localhost:35909/tenant1/authorize",
        "token_endpoint": "http://localhost:35909/tenant1/token",
        "registration_endpoint": "http://localhost:35909/tenant1/register",
        "response_types_supported": [
          "code"
        ],
        "grant_types_supported": [
          "authorization_code",
          "refresh_token"
        ],
        "code_challenge_methods_supported": [
          "S256"
        ],
        "token_endpoint_auth_methods_supported": [
          "none"
        ]
      }
    }
  },

Should this behavior be adjusted?

To Reproduce
Steps to reproduce the behavior:

  1. Run metadata-var2 or metadata-var3 conformance test with a working SDK and inspect checks.json.

Expected behavior
I would expect the issuer field to contain the path component used to construct the AS metadata URL.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run the metadata-var2 or metadata-var3 conformance test and inspect checks.json, focusing on the issuer returned for the metadata URL containing /tenant1. Compare the observed issuer with the RFC 8414 validation requirement and determine whether the test expectation or authorization-server response should change. Done means the behavior and expected issuer value are resolved for these tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, typescript
Domain
authentication, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.