modelcontextprotocol / modelcontextprotocol/csharp-sdk

WWW-Authenticate header does not contain a resource metadata params

Open
#1,050 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

area-auth bug P2
Dominant language
C#
Stars
4.5k
Forks
814
Avg merge
9d 19h
Merged PRs (30d)
4

Description

Describe the bug
I attempted to connect to the Atlassian Remote MCP Server (https://mcp.atlassian.com/v1/sse) using HttpClientTransport and successfully initialized the client. However, I’m encountering an issue that appears after the initial handshake. The 401-response header’s WWW-Authenticate field does not include the resource metadata parameters. This behavior is present with some other remote MCP servers that also no resource metadata.

I haven’t found a way to bypass this resource metadata check and proceed directly to the authorization server metadata discovery, even though this remote MCP server exposes it at:
https://mcp.atlassian.com/.well-known/oauth-authorization-server

To Reproduce
Steps to reproduce the behavior:

  1. Create HttpTransportClient with OAuth.
  2. Initialized the client.

Logs

Unhandled exception. ModelContextProtocol.McpException: The WWW-Authenticate header does not contain a resource_metadata parameter
   at ModelContextProtocol.Authentication.ClientOAuthProvider.ExtractProtectedResourceMetadata(HttpResponseMessage response, Uri serverUrl, CancellationToken cancellationToken)
   at ModelContextProtocol.Authentication.ClientOAuthProvider.PerformOAuthAuthorizationAsync(HttpResponseMessage response, CancellationToken cancellationToken)
   at ModelContextProtocol.Authentication.ClientOAuthProvider.HandleUnauthorizedResponseAsync(String scheme, HttpResponseMessage response, CancellationToken cancellationToken)
   at ModelContextProtocol.Authentication.AuthenticatingMcpHttpClient.HandleUnauthorizedResponseAsync(HttpRequestMessage originalRequest, JsonRpcMessage originalJsonRpcMessage, HttpResponseMessage response, CancellationToken cancellationToken)
   at ModelContextProtocol.Authentication.AuthenticatingMcpHttpClient.SendAsync(HttpRequestMessage request, JsonRpcMessage message, CancellationToken cancellationToken)
   at ModelContextProtocol.Client.StreamableHttpClientSessionTransport.SendHttpRequestAsync(JsonRpcMessage message, CancellationToken cancellationToken)
   at ModelContextProtocol.Client.AutoDetectingClientSessionTransport.InitializeAsync(JsonRpcMessage message, CancellationToken cancellationToken)
   at ModelContextProtocol.Client.AutoDetectingClientSessionTransport.InitializeAsync(JsonRpcMessage message, CancellationToken cancellationToken)
   at ModelContextProtocol.McpSessionHandler.SendRequestAsync(JsonRpcRequest request, CancellationToken cancellationToken)
   at ModelContextProtocol.McpSession.SendRequestAsync[TParameters,TResult](String method, TParameters parameters, JsonTypeInfo`1 parametersTypeInfo, JsonTypeInfo`1 resultTypeInfo, RequestId requestId, CancellationToken cancellationToken)
   at ModelContextProtocol.Client.McpClientImpl.ConnectAsync(CancellationToken cancellationToken)
   at ModelContextProtocol.Client.McpClientImpl.ConnectAsync(CancellationToken cancellationToken)
   at ModelContextProtocol.Client.McpClient.CreateAsync(IClientTransport clientTransport, McpClientOptions clientOptions, ILoggerFactory loggerFactory, CancellationToken cancellationToken)
   at ModelContextProtocol.Client.McpClient.CreateAsync(IClientTransport clientTransport, McpClientOptions clientOptions, ILoggerFactory loggerFactory, CancellationToken cancellationToken)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at ClientOAuthProvider.ExtractProtectedResourceMetadata and follow its call from PerformOAuthAuthorizationAsync in the stack trace. Reproduce the 401 response from the Atlassian Remote MCP Server, then verify that OAuth authorization-server metadata discovery can proceed when WWW-Authenticate lacks a resource_metadata parameter.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api, authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.