modelcontextprotocol / modelcontextprotocol/csharp-sdk
WWW-Authenticate header does not contain a resource metadata params
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 4.5k
- Forks
- 814
- Avg merge
- 9d 19h
- Merged PRs (30d)
- 4
Description
Describe the bug
I attempted to connect to the Atlassian Remote MCP Server (https://mcp.atlassian.com/v1/sse) using HttpClientTransport and successfully initialized the client. However, I’m encountering an issue that appears after the initial handshake. The 401-response header’s WWW-Authenticate field does not include the resource metadata parameters. This behavior is present with some other remote MCP servers that also no resource metadata.
I haven’t found a way to bypass this resource metadata check and proceed directly to the authorization server metadata discovery, even though this remote MCP server exposes it at:
https://mcp.atlassian.com/.well-known/oauth-authorization-server
To Reproduce
Steps to reproduce the behavior:
- Create HttpTransportClient with OAuth.
- Initialized the client.
Logs
Unhandled exception. ModelContextProtocol.McpException: The WWW-Authenticate header does not contain a resource_metadata parameter
at ModelContextProtocol.Authentication.ClientOAuthProvider.ExtractProtectedResourceMetadata(HttpResponseMessage response, Uri serverUrl, CancellationToken cancellationToken)
at ModelContextProtocol.Authentication.ClientOAuthProvider.PerformOAuthAuthorizationAsync(HttpResponseMessage response, CancellationToken cancellationToken)
at ModelContextProtocol.Authentication.ClientOAuthProvider.HandleUnauthorizedResponseAsync(String scheme, HttpResponseMessage response, CancellationToken cancellationToken)
at ModelContextProtocol.Authentication.AuthenticatingMcpHttpClient.HandleUnauthorizedResponseAsync(HttpRequestMessage originalRequest, JsonRpcMessage originalJsonRpcMessage, HttpResponseMessage response, CancellationToken cancellationToken)
at ModelContextProtocol.Authentication.AuthenticatingMcpHttpClient.SendAsync(HttpRequestMessage request, JsonRpcMessage message, CancellationToken cancellationToken)
at ModelContextProtocol.Client.StreamableHttpClientSessionTransport.SendHttpRequestAsync(JsonRpcMessage message, CancellationToken cancellationToken)
at ModelContextProtocol.Client.AutoDetectingClientSessionTransport.InitializeAsync(JsonRpcMessage message, CancellationToken cancellationToken)
at ModelContextProtocol.Client.AutoDetectingClientSessionTransport.InitializeAsync(JsonRpcMessage message, CancellationToken cancellationToken)
at ModelContextProtocol.McpSessionHandler.SendRequestAsync(JsonRpcRequest request, CancellationToken cancellationToken)
at ModelContextProtocol.McpSession.SendRequestAsync[TParameters,TResult](String method, TParameters parameters, JsonTypeInfo`1 parametersTypeInfo, JsonTypeInfo`1 resultTypeInfo, RequestId requestId, CancellationToken cancellationToken)
at ModelContextProtocol.Client.McpClientImpl.ConnectAsync(CancellationToken cancellationToken)
at ModelContextProtocol.Client.McpClientImpl.ConnectAsync(CancellationToken cancellationToken)
at ModelContextProtocol.Client.McpClient.CreateAsync(IClientTransport clientTransport, McpClientOptions clientOptions, ILoggerFactory loggerFactory, CancellationToken cancellationToken)
at ModelContextProtocol.Client.McpClient.CreateAsync(IClientTransport clientTransport, McpClientOptions clientOptions, ILoggerFactory loggerFactory, CancellationToken cancellationToken)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at ClientOAuthProvider.ExtractProtectedResourceMetadata and follow its call from PerformOAuthAuthorizationAsync in the stack trace. Reproduce the 401 response from the Atlassian Remote MCP Server, then verify that OAuth authorization-server metadata discovery can proceed when WWW-Authenticate lacks a resource_metadata parameter.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100