fix: skip eager token refresh when OAuth metadata is unavailable (#3240) - #3246
Closed
zsxh1990 wants to merge 2 commits into
Closed
fix: skip eager token refresh when OAuth metadata is unavailable (#3240)#3246zsxh1990 wants to merge 2 commits into
zsxh1990 wants to merge 2 commits into
Conversation
Copy link
Copy Markdown
Sorry, something went wrong.
When the auth server lives under a non-root path (e.g. /oauth2/api/v1/token), the eager refresh at the top of async_auth_flow used the fallback urljoin(get_authorization_base_url(server_url), '/token') which strips the path, hitting the wrong endpoint. Fix: only attempt the eager refresh when oauth_metadata is already populated (i.e. we know the real token_endpoint). Without metadata, let the request proceed with the stale token, receive a 401, and run full PRM/ASM discovery before retrying — which resolves the correct token endpoint. Includes regression test: test_auth_flow_skips_eager_refresh_when_metadata_missing Fixes modelcontextprotocol#3240
zsxh1990
force-pushed
the
fix/oauth-refresh-metadata-discovery
branch
from
c80b05e to
a9d322e
Compare
August 4, 2026 09:17
Copy link
Copy Markdown
Author
|
Hi team — friendly ping on this PR 🙂 CI is fully green (29/29 checks pass) and Cubic AI reviewer found no issues. This fixes the OAuth token refresh hitting the wrong endpoint when the auth server lives under a non-root path (issue #3240). Happy to address any feedback! |
Sorry, something went wrong.
Copy link
Copy Markdown
Contributor
|
Thanks for the PR. We're tracking this fix in #3263 instead, so I'm closing this one. Feel free to reopen if this is still relevant. |
Sorry, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When the authorization server lives under a non-root path (e.g. https://host/oauth2/api/v1/token), the eager token refresh at the top of async_auth_flow hits the wrong endpoint.
Root cause: _refresh_token falls back to urljoin(get_authorization_base_url(server_url), "/token") when oauth_metadata is None. get_authorization_base_url strips the path, so a server at /oauth2/api/v1/token gets https://host/token instead.
This happens because the eager refresh runs before any PRM/ASM metadata discovery — so oauth_metadata is always None on a restart with cached-but-expired tokens.
Fix
Add and self.context.oauth_metadata is not None to the eager refresh guard. When metadata is missing:
This is correct because:
Fixes #3240