Uh oh!
There was an error while loading. Please reload this page.
OAuth TokenHandler Enhancement: Authorization Header Fallback Support - #1316
OAuth TokenHandler Enhancement: Authorization Header Fallback Support#1316ChenyangLi4288 wants to merge 5 commits into
Conversation
…tials - Implement fallback logic in TokenHandler to check Authorization header when client credentials are missing from form data - Support Basic authentication with proper Base64 decoding and URL decoding - Add comprehensive test suite covering all scenarios - Maintain backward compatibility with existing form data authentication - Improve OAuth 2.0 compliance by supporting both client_secret_post and client_secret_basic methods Fixesmodelcontextprotocol#1315
…tests - Fix abstract method signatures in MockOAuthProvider - Correct Request constructor usage in mock_request fixture - Add proper type annotations and type ignore comments - Fix line length issues and import from collections.abc - Ensure all tests pass type checking and linting
- Implement fallback to extract client credentials from Authorization header - Support Basic authentication when client_id is missing from form data - Handle URL-encoded client secrets properly - Add comprehensive test coverage for the new functionality - Follows OAuth 2.0 RFC 6749 specifications for client authentication Fixesmodelcontextprotocol#1315
| @@ -0,0 +1,122 @@ | |||
| # OAuth TokenHandler Enhancement - Issue #1315 | |||
There was a problem hiding this comment.
Was this intentionally included? We shouldn't be adding large .md files describing a specific implementation fix.
There was a problem hiding this comment.
Deleted! That makes sense. It's my first time contributing to this project didn't realize it's not necessary.
ochafik
commented
Sep 29, 2025
Hi @ChenyangLi4288 , thanks for sending this PR! It looks like #1334 might be a preferable approach as it also deals with advertising the new method in auth_methods_supported, returns 401s for auth failures and updates the ClientAuthenticator "middleware" instead of the token handler. (Please feel free to comment on the other PR or let me know if you feel strongly like this should be reopened) Cheers |
OAuth TokenHandler Enhancement: Authorization Header Fallback Support
This PR implements the enhancement requested in issue #1315 to add fallback support for OAuth client credentials in the Authorization header when they are missing from the request form data. This improves OAuth 2.0 compliance by supporting both
client_secret_postandclient_secret_basicauthentication methods.Changes Made
Fixes#1315
This PR adds fallback support for OAuth client credentials in the Authorization header when they are missing from the request form data. The TokenHandler now checks for Basic authentication in the Authorization header as a fallback, improving OAuth 2.0 compliance by supporting both client_secret_post and client_secret_basic methods.
Motivation and Context
Currently, the TokenHandler only looks for client credentials in the request form data. However, according to OAuth 2.0 specifications, client credentials can also be provided in the Authorization header using Basic authentication. When credentials are only provided in the header, the handler throws a ValidationError even though valid credentials are present. This enhancement addresses this limitation by implementing a fallback mechanism.
How Has This Been Tested?
Comprehensive tests have been added covering:
All new tests pass (7/7) and existing tests continue to pass. Code passes linting (ruff) and type checking (pyright).
Breaking Changes
None. This is a purely additive enhancement that maintains 100% backward compatibility. Existing OAuth clients using form data authentication will continue to work exactly as before.
Types of changes
Checklist
Additional context
The implementation follows OAuth 2.0 best practices and maintains the security model while improving flexibility for different client implementations. It's particularly useful for web applications, mobile apps, and enterprise integrations that prefer using Basic authentication headers. The enhancement is non-intrusive and only activates when credentials are missing from form data, ensuring minimal performance impact.