feat: allow opting into private oauth metadata hosts#954

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
DaleSeo wants to merge 2 commits into from
Closed

feat: allow opting into private oauth metadata hosts #954

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
24565e9
feat: allow opting into private oauth metadata hosts
DaleSeo Jul 3, 2026
a341aec
test: opt conformance client into private metadata hosts
DaleSeo Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions conformance/src/bin/client.rs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -192,6 +192,9 @@ async fn perform_oauth_flow(
_ctx: &ConformanceContext,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
let mut oauth = OAuthState::new(server_url, None).await?;
// The conformance authorization server runs on loopback; opt in so metadata
// discovery is not blocked by the SSRF guard.
oauth.set_allow_private_metadata_hosts(true);

// Discover + register + get auth URL
oauth
Expand DownExpand Up@@ -242,6 +245,9 @@ async fn perform_oauth_flow_preregistered(
client_secret: &str,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
let mut manager = AuthorizationManager::new(server_url).await?;
// The conformance authorization server runs on loopback; opt in so metadata
// discovery is not blocked by the SSRF guard.
manager.set_allow_private_metadata_hosts(true);
let metadata = manager.discover_metadata().await?;
manager.set_metadata(metadata);

Expand DownExpand Up@@ -316,6 +322,9 @@ async fn run_auth_scope_step_up_client(
) -> anyhow::Result<()> {
// First auth
let mut oauth = OAuthState::new(server_url, None).await?;
// The conformance authorization server runs on loopback; opt in so metadata
// discovery is not blocked by the SSRF guard.
oauth.set_allow_private_metadata_hosts(true);
oauth
.start_authorization_with_metadata_url(
&[],
Expand DownExpand Up@@ -368,6 +377,7 @@ async fn run_auth_scope_step_up_client(
// Re-do the full flow; the server will give us the right scopes
// on the second authorization request.
let mut oauth2 = OAuthState::new(server_url, None).await?;
oauth2.set_allow_private_metadata_hosts(true);
// Pass the escalated scope hint
oauth2
.start_authorization_with_metadata_url(
Expand DownExpand Up@@ -417,6 +427,9 @@ async fn run_auth_scope_retry_limit_client(

loop {
let mut oauth = OAuthState::new(server_url, None).await?;
// The conformance authorization server runs on loopback; opt in so metadata
// discovery is not blocked by the SSRF guard.
oauth.set_allow_private_metadata_hosts(true);
oauth
.start_authorization_with_metadata_url(
&[],
Expand DownExpand Up@@ -524,6 +537,9 @@ async fn run_client_credentials_basic(
.unwrap_or("conformance-test-secret");

let mut manager = AuthorizationManager::new(server_url).await?;
// The conformance authorization server runs on loopback; opt in so metadata
// discovery is not blocked by the SSRF guard.
manager.set_allow_private_metadata_hosts(true);
let metadata = manager.discover_metadata().await?;
let token_endpoint = metadata.token_endpoint.clone();
manager.set_metadata(metadata);
Expand DownExpand Up@@ -582,6 +598,9 @@ async fn run_client_credentials_jwt(

// Discover metadata to get token endpoint
let mut manager = AuthorizationManager::new(server_url).await?;
// The conformance authorization server runs on loopback; opt in so metadata
// discovery is not blocked by the SSRF guard.
manager.set_allow_private_metadata_hosts(true);
let metadata = manager.discover_metadata().await?;
let token_endpoint = metadata.token_endpoint.clone();
manager.set_metadata(metadata);
Expand Down
150 changes: 132 additions & 18 deletions crates/rmcp/src/transport/auth.rs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
use std::{
collections::HashMap,
future::Future,
net::{IpAddr, Ipv4Addr, Ipv6Addr},
net::{Ipv4Addr, Ipv6Addr},
pin::Pin,
sync::Arc,
time::{Duration, SystemTime, UNIX_EPOCH},
Expand DownExpand Up@@ -780,6 +780,10 @@ pub struct AuthorizationManager {
resource_scopes: RwLock<Vec<String>>,
/// OIDC Dynamic Client Registration `application_type` (SEP-837)
application_type: Option<String>,
/// Allow loopback and private-network authorization server metadata hosts.
/// Off by default to prevent SSRF; opt in for local development or
/// internal deployments. Cloud-metadata and link-local hosts stay blocked.
allow_private_metadata_hosts: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
Expand DownExpand Up@@ -859,17 +863,22 @@ impl AuthorizationManager {
|| (octets[0] == 198 && matches!(octets[1], 18 | 19))
}

/// `fe80::/10`, the IPv6 unicast link-local range (`Ipv6Addr::is_unicast_link_local`
/// is still unstable, so match the prefix directly).
fn is_ipv6_link_local(addr: Ipv6Addr) -> bool {
(addr.segments()[0] & 0xffc0) == 0xfe80
}

fn is_disallowed_metadata_ipv6(addr: Ipv6Addr) -> bool {
if let Some(mapped) = addr.to_ipv4_mapped() {
return Self::is_disallowed_metadata_ipv4(mapped);
}

let segments = addr.segments();
addr.is_loopback()
|| addr.is_unspecified()
|| addr.is_multicast()
|| (segments[0] & 0xffc0) == 0xfe80
|| (segments[0] & 0xfe00) == 0xfc00
|| Self::is_ipv6_link_local(addr)
|| (addr.segments()[0] & 0xfe00) == 0xfc00
}

fn is_disallowed_metadata_hostname(host: &str) -> bool {
Expand All@@ -878,24 +887,54 @@ impl AuthorizationManager {
|| CLOUD_METADATA_HOSTS.contains(&host)
}

fn is_disallowed_metadata_host(host: &str) -> bool {
let host = host.trim_end_matches('.').to_ascii_lowercase();
if Self::is_disallowed_metadata_hostname(&host) {
return true;
fn is_disallowed_metadata_host(host: &url::Host<&str>) -> bool {
match host {
url::Host::Domain(name) => Self::is_disallowed_metadata_hostname(
&name.trim_end_matches('.').to_ascii_lowercase(),
),
url::Host::Ipv4(addr) => Self::is_disallowed_metadata_ipv4(*addr),
url::Host::Ipv6(addr) => Self::is_disallowed_metadata_ipv6(*addr),
}
}

match host.parse::<IpAddr>() {
Ok(IpAddr::V4(addr)) => Self::is_disallowed_metadata_ipv4(addr),
Ok(IpAddr::V6(addr)) => Self::is_disallowed_metadata_ipv6(addr),
Err(_) => false,
/// Hosts that are never a legitimate authorization server and stay rejected
/// even when private metadata hosts are explicitly allowed: cloud-metadata
/// service hostnames and link-local addresses (e.g. `169.254.169.254`),
/// which are the classic SSRF pivots.
fn is_metadata_ssrf_sink(host: &url::Host<&str>) -> bool {
match host {
url::Host::Domain(name) => CLOUD_METADATA_HOSTS
.contains(&name.trim_end_matches('.').to_ascii_lowercase().as_str()),
url::Host::Ipv4(addr) => addr.is_link_local(),
// Match the IPv4-mapped form too, so `::ffff:169.254.169.254` can't
// slip a link-local address past the sink check.
url::Host::Ipv6(addr) => match addr.to_ipv4_mapped() {
Some(mapped) => mapped.is_link_local(),
None => Self::is_ipv6_link_local(*addr),
},
}
}

fn is_allowed_authorization_server_metadata_url(url: &Url) -> bool {
Self::is_http_url(url)
&& url
.host_str()
.is_some_and(|host| !Self::is_disallowed_metadata_host(host))
fn is_allowed_authorization_server_metadata_url(&self, url: &Url) -> bool {
if !Self::is_http_url(url) {
return false;
}
// Use the typed host rather than `host_str()` so IPv6 literals are
// matched as addresses instead of a bracketed string that never parses.
let Some(host) = url.host() else {
return false;
};
// Cloud-metadata and link-local hosts are never a valid authorization
// server; reject them regardless of configuration.
if Self::is_metadata_ssrf_sink(&host) {
return false;
}
// Loopback and private-network hosts are rejected by default to prevent
// SSRF, but can be explicitly allowed for local or internal deployments.
if self.allow_private_metadata_hosts {
return true;
}
!Self::is_disallowed_metadata_host(&host)
}

fn resolve_resource_metadata_url(value: &str, base_url: &Url) -> Option<Url> {
Expand DownExpand Up@@ -993,6 +1032,7 @@ impl AuthorizationManager {
www_auth_scopes: RwLock::new(Vec::new()),
resource_scopes: RwLock::new(Vec::new()),
application_type: Some(DEFAULT_APPLICATION_TYPE.to_string()),
allow_private_metadata_hosts: false,
};

Ok(manager)
Expand All@@ -1003,6 +1043,17 @@ impl AuthorizationManager {
self.scope_upgrade_config = config;
}

/// Allow loopback and private-network hosts as authorization servers.
///
/// By default these are rejected to prevent SSRF, which also blocks
/// legitimate local development (`http://localhost`, `127.0.0.1`) and
/// internal enterprise deployments (RFC 1918 addresses). Enable this only
/// when the authorization server is trusted. Cloud-metadata endpoints and
/// link-local addresses (e.g. `169.254.169.254`) remain blocked either way.
pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
self.allow_private_metadata_hosts = allow;
}

/// Set a custom credential store
///
/// This allows you to provide your own implementation of credential storage,
Expand DownExpand Up@@ -1885,7 +1936,7 @@ impl AuthorizationManager {
},
};

if !Self::is_allowed_authorization_server_metadata_url(&candidate_url) {
if !self.is_allowed_authorization_server_metadata_url(&candidate_url) {
warn!("rejecting authorization server metadata URL `{candidate_url}`");
continue;
}
Expand DownExpand Up@@ -2849,6 +2900,18 @@ impl OAuthState {
Ok(OAuthState::Unauthorized(manager))
}

/// Allow loopback and private-network authorization server hosts.
///
/// Must be called before authorization begins, while the state is still
/// unauthorized (metadata discovery is where the host is validated). See
/// [`AuthorizationManager::set_allow_private_metadata_hosts`] for the
/// security implications.
pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
if let OAuthState::Unauthorized(manager) = self {
manager.set_allow_private_metadata_hosts(allow);
}
}

/// Get client_id and OAuth credentials
pub async fn get_credentials(&self) -> Result<Credentials, AuthError> {
// return client_id and credentials
Expand DownExpand Up@@ -3406,6 +3469,57 @@ mod tests {
);
}

async fn metadata_guard_manager(allow_private: bool) -> AuthorizationManager {
let client = RecordingOAuthHttpClient::with_responses(vec![]);
let mut manager = AuthorizationManager::new_with_oauth_http_client(
"https://mcp.example.com/mcp",
Arc::new(client),
)
.await
.unwrap();
manager.set_allow_private_metadata_hosts(allow_private);
manager
}

#[tokio::test]
async fn rejects_loopback_authorization_server_by_default() {
let manager = metadata_guard_manager(false).await;
let url = Url::parse("http://127.0.0.1:9000/").unwrap();
assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
}

#[tokio::test]
async fn allows_private_authorization_server_when_opted_in() {
let manager = metadata_guard_manager(true).await;
let loopback = Url::parse("http://127.0.0.1:9000/").unwrap();
let private = Url::parse("http://10.0.0.5/.well-known/oauth-authorization-server").unwrap();
assert!(manager.is_allowed_authorization_server_metadata_url(&loopback));
assert!(manager.is_allowed_authorization_server_metadata_url(&private));
}

#[tokio::test]
async fn rejects_ssrf_sinks_even_when_private_hosts_allowed() {
let manager = metadata_guard_manager(true).await;
let link_local = Url::parse("http://169.254.169.254/latest/meta-data/").unwrap();
let cloud_metadata = Url::parse("http://metadata.google.internal/").unwrap();
assert!(!manager.is_allowed_authorization_server_metadata_url(&link_local));
assert!(!manager.is_allowed_authorization_server_metadata_url(&cloud_metadata));
}

#[tokio::test]
async fn rejects_ipv4_mapped_link_local_when_private_hosts_allowed() {
let manager = metadata_guard_manager(true).await;
let mapped = Url::parse("http://[::ffff:169.254.169.254]/latest/meta-data/").unwrap();
assert!(!manager.is_allowed_authorization_server_metadata_url(&mapped));
}

#[tokio::test]
async fn rejects_ipv6_loopback_authorization_server_by_default() {
let manager = metadata_guard_manager(false).await;
let url = Url::parse("http://[::1]:9000/").unwrap();
assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
}

#[tokio::test]
async fn protected_resource_discovery_rejects_mismatched_resource() {
let challenge = oauth2::http::Response::builder()
Expand Down
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat: allow opting into private oauth metadata hosts#954

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

DaleSeo
wants to merge
2
commits into

from

 Closed


feat: allow opting into private oauth metadata hosts
#954
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
24565e9

feat: allow opting into private oauth metadata hosts


DaleSeo Jul 3, 2026
a341aec

test: opt conformance client into private metadata hosts


DaleSeo Jul 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
conformance/src/bin/client.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -192,6 +192,9 @@ async fn perform_oauth_flow(
 _ctx: &ConformanceContext,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);

 // Discover + register + get auth URL
 oauth
Expand DownExpand Up@@ -242,6 +245,9 @@ async fn perform_oauth_flow_preregistered(
 client_secret: &str,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 manager.set_metadata(metadata);

Expand DownExpand Up@@ -316,6 +322,9 @@ async fn run_auth_scope_step_up_client(
) -> anyhow::Result<()> {
 // First auth
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -368,6 +377,7 @@ async fn run_auth_scope_step_up_client(
 // Re-do the full flow; the server will give us the right scopes
 // on the second authorization request.
 let mut oauth2 = OAuthState::new(server_url, None).await?;
 oauth2.set_allow_private_metadata_hosts(true);
 // Pass the escalated scope hint
 oauth2
 .start_authorization_with_metadata_url(
Expand DownExpand Up@@ -417,6 +427,9 @@ async fn run_auth_scope_retry_limit_client(

 loop {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -524,6 +537,9 @@ async fn run_client_credentials_basic(
 .unwrap_or("conformance-test-secret");

 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand DownExpand Up@@ -582,6 +598,9 @@ async fn run_client_credentials_jwt(

 // Discover metadata to get token endpoint
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand Down

150 changes: 132 additions & 18 deletions
crates/rmcp/src/transport/auth.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
use std::{
 collections::HashMap,
 future::Future,
 net::{IpAddr, Ipv4Addr, Ipv6Addr},
 net::{Ipv4Addr, Ipv6Addr},
 pin::Pin,
 sync::Arc,
 time::{Duration, SystemTime, UNIX_EPOCH},
Expand DownExpand Up@@ -780,6 +780,10 @@ pub struct AuthorizationManager {
 resource_scopes: RwLock<Vec<String>>,
 /// OIDC Dynamic Client Registration `application_type` (SEP-837)
 application_type: Option<String>,
 /// Allow loopback and private-network authorization server metadata hosts.
 /// Off by default to prevent SSRF; opt in for local development or
 /// internal deployments. Cloud-metadata and link-local hosts stay blocked.
 allow_private_metadata_hosts: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
Expand DownExpand Up@@ -859,17 +863,22 @@ impl AuthorizationManager {
 || (octets[0] == 198 && matches!(octets[1], 18 | 19))
 }

 /// `fe80::/10`, the IPv6 unicast link-local range (`Ipv6Addr::is_unicast_link_local`
 /// is still unstable, so match the prefix directly).
 fn is_ipv6_link_local(addr: Ipv6Addr) -> bool {
 (addr.segments()[0] & 0xffc0) == 0xfe80
 }

 fn is_disallowed_metadata_ipv6(addr: Ipv6Addr) -> bool {
 if let Some(mapped) = addr.to_ipv4_mapped() {
 return Self::is_disallowed_metadata_ipv4(mapped);
 }

 let segments = addr.segments();
 addr.is_loopback()
 || addr.is_unspecified()
 || addr.is_multicast()
 || (segments[0] & 0xffc0) == 0xfe80
 || (segments[0] & 0xfe00) == 0xfc00
 || Self::is_ipv6_link_local(addr)
 || (addr.segments()[0] & 0xfe00) == 0xfc00
 }

 fn is_disallowed_metadata_hostname(host: &str) -> bool {
Expand All@@ -878,24 +887,54 @@ impl AuthorizationManager {
 || CLOUD_METADATA_HOSTS.contains(&host)
 }

 fn is_disallowed_metadata_host(host: &str) -> bool {
 let host = host.trim_end_matches('.').to_ascii_lowercase();
 if Self::is_disallowed_metadata_hostname(&host) {
 return true;
 fn is_disallowed_metadata_host(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => Self::is_disallowed_metadata_hostname(
 &name.trim_end_matches('.').to_ascii_lowercase(),
 ),
 url::Host::Ipv4(addr) => Self::is_disallowed_metadata_ipv4(*addr),
 url::Host::Ipv6(addr) => Self::is_disallowed_metadata_ipv6(*addr),
 }
 }

 match host.parse::<IpAddr>() {
 Ok(IpAddr::V4(addr)) => Self::is_disallowed_metadata_ipv4(addr),
 Ok(IpAddr::V6(addr)) => Self::is_disallowed_metadata_ipv6(addr),
 Err(_) => false,
 /// Hosts that are never a legitimate authorization server and stay rejected
 /// even when private metadata hosts are explicitly allowed: cloud-metadata
 /// service hostnames and link-local addresses (e.g. `169.254.169.254`),
 /// which are the classic SSRF pivots.
 fn is_metadata_ssrf_sink(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => CLOUD_METADATA_HOSTS
 .contains(&name.trim_end_matches('.').to_ascii_lowercase().as_str()),
 url::Host::Ipv4(addr) => addr.is_link_local(),
 // Match the IPv4-mapped form too, so `::ffff:169.254.169.254` can't
 // slip a link-local address past the sink check.
 url::Host::Ipv6(addr) => match addr.to_ipv4_mapped() {
 Some(mapped) => mapped.is_link_local(),
 None => Self::is_ipv6_link_local(*addr),
 },
 }
 }

 fn is_allowed_authorization_server_metadata_url(url: &Url) -> bool {
 Self::is_http_url(url)
 && url
 .host_str()
 .is_some_and(|host| !Self::is_disallowed_metadata_host(host))
 fn is_allowed_authorization_server_metadata_url(&self, url: &Url) -> bool {
 if !Self::is_http_url(url) {
 return false;
 }
 // Use the typed host rather than `host_str()` so IPv6 literals are
 // matched as addresses instead of a bracketed string that never parses.
 let Some(host) = url.host() else {
 return false;
 };
 // Cloud-metadata and link-local hosts are never a valid authorization
 // server; reject them regardless of configuration.
 if Self::is_metadata_ssrf_sink(&host) {
 return false;
 }
 // Loopback and private-network hosts are rejected by default to prevent
 // SSRF, but can be explicitly allowed for local or internal deployments.
 if self.allow_private_metadata_hosts {
 return true;
 }
 !Self::is_disallowed_metadata_host(&host)
 }

 fn resolve_resource_metadata_url(value: &str, base_url: &Url) -> Option<Url> {
Expand DownExpand Up@@ -993,6 +1032,7 @@ impl AuthorizationManager {
 www_auth_scopes: RwLock::new(Vec::new()),
 resource_scopes: RwLock::new(Vec::new()),
 application_type: Some(DEFAULT_APPLICATION_TYPE.to_string()),
 allow_private_metadata_hosts: false,
 };

 Ok(manager)
Expand All@@ -1003,6 +1043,17 @@ impl AuthorizationManager {
 self.scope_upgrade_config = config;
 }

 /// Allow loopback and private-network hosts as authorization servers.
 ///
 /// By default these are rejected to prevent SSRF, which also blocks
 /// legitimate local development (`http://localhost`, `127.0.0.1`) and
 /// internal enterprise deployments (RFC 1918 addresses). Enable this only
 /// when the authorization server is trusted. Cloud-metadata endpoints and
 /// link-local addresses (e.g. `169.254.169.254`) remain blocked either way.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 self.allow_private_metadata_hosts = allow;
 }

 /// Set a custom credential store
 ///
 /// This allows you to provide your own implementation of credential storage,
Expand DownExpand Up@@ -1885,7 +1936,7 @@ impl AuthorizationManager {
 },
 };

 if !Self::is_allowed_authorization_server_metadata_url(&candidate_url) {
 if !self.is_allowed_authorization_server_metadata_url(&candidate_url) {
 warn!("rejecting authorization server metadata URL `{candidate_url}`");
 continue;
 }
Expand DownExpand Up@@ -2849,6 +2900,18 @@ impl OAuthState {
 Ok(OAuthState::Unauthorized(manager))
 }

 /// Allow loopback and private-network authorization server hosts.
 ///
 /// Must be called before authorization begins, while the state is still
 /// unauthorized (metadata discovery is where the host is validated). See
 /// [`AuthorizationManager::set_allow_private_metadata_hosts`] for the
 /// security implications.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 if let OAuthState::Unauthorized(manager) = self {
 manager.set_allow_private_metadata_hosts(allow);
 }
 }

 /// Get client_id and OAuth credentials
 pub async fn get_credentials(&self) -> Result<Credentials, AuthError> {
 // return client_id and credentials
Expand DownExpand Up@@ -3406,6 +3469,57 @@ mod tests {
 );
 }

 async fn metadata_guard_manager(allow_private: bool) -> AuthorizationManager {
 let client = RecordingOAuthHttpClient::with_responses(vec![]);
 let mut manager = AuthorizationManager::new_with_oauth_http_client(
 "https://mcp.example.com/mcp",
 Arc::new(client),
 )
 .await
 .unwrap();
 manager.set_allow_private_metadata_hosts(allow_private);
 manager
 }

 #[tokio::test]
 async fn rejects_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://127.0.0.1:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn allows_private_authorization_server_when_opted_in() {
 let manager = metadata_guard_manager(true).await;
 let loopback = Url::parse("http://127.0.0.1:9000/").unwrap();
 let private = Url::parse("http://10.0.0.5/.well-known/oauth-authorization-server").unwrap();
 assert!(manager.is_allowed_authorization_server_metadata_url(&loopback));
 assert!(manager.is_allowed_authorization_server_metadata_url(&private));
 }

 #[tokio::test]
 async fn rejects_ssrf_sinks_even_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let link_local = Url::parse("http://169.254.169.254/latest/meta-data/").unwrap();
 let cloud_metadata = Url::parse("http://metadata.google.internal/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&link_local));
 assert!(!manager.is_allowed_authorization_server_metadata_url(&cloud_metadata));
 }

 #[tokio::test]
 async fn rejects_ipv4_mapped_link_local_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let mapped = Url::parse("http://[::ffff:169.254.169.254]/latest/meta-data/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&mapped));
 }

 #[tokio::test]
 async fn rejects_ipv6_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://[::1]:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn protected_resource_discovery_rejects_mismatched_resource() {
 let challenge = oauth2::http::Response::builder()
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: allow opting into private oauth metadata hosts#954

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

DaleSeo
wants to merge
2
commits into

from

 Closed


feat: allow opting into private oauth metadata hosts
#954
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
24565e9

feat: allow opting into private oauth metadata hosts


DaleSeo Jul 3, 2026
a341aec

test: opt conformance client into private metadata hosts


DaleSeo Jul 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
conformance/src/bin/client.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -192,6 +192,9 @@ async fn perform_oauth_flow(
 _ctx: &ConformanceContext,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);

 // Discover + register + get auth URL
 oauth
Expand DownExpand Up@@ -242,6 +245,9 @@ async fn perform_oauth_flow_preregistered(
 client_secret: &str,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 manager.set_metadata(metadata);

Expand DownExpand Up@@ -316,6 +322,9 @@ async fn run_auth_scope_step_up_client(
) -> anyhow::Result<()> {
 // First auth
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -368,6 +377,7 @@ async fn run_auth_scope_step_up_client(
 // Re-do the full flow; the server will give us the right scopes
 // on the second authorization request.
 let mut oauth2 = OAuthState::new(server_url, None).await?;
 oauth2.set_allow_private_metadata_hosts(true);
 // Pass the escalated scope hint
 oauth2
 .start_authorization_with_metadata_url(
Expand DownExpand Up@@ -417,6 +427,9 @@ async fn run_auth_scope_retry_limit_client(

 loop {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -524,6 +537,9 @@ async fn run_client_credentials_basic(
 .unwrap_or("conformance-test-secret");

 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand DownExpand Up@@ -582,6 +598,9 @@ async fn run_client_credentials_jwt(

 // Discover metadata to get token endpoint
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand Down

150 changes: 132 additions & 18 deletions
crates/rmcp/src/transport/auth.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
use std::{
 collections::HashMap,
 future::Future,
 net::{IpAddr, Ipv4Addr, Ipv6Addr},
 net::{Ipv4Addr, Ipv6Addr},
 pin::Pin,
 sync::Arc,
 time::{Duration, SystemTime, UNIX_EPOCH},
Expand DownExpand Up@@ -780,6 +780,10 @@ pub struct AuthorizationManager {
 resource_scopes: RwLock<Vec<String>>,
 /// OIDC Dynamic Client Registration `application_type` (SEP-837)
 application_type: Option<String>,
 /// Allow loopback and private-network authorization server metadata hosts.
 /// Off by default to prevent SSRF; opt in for local development or
 /// internal deployments. Cloud-metadata and link-local hosts stay blocked.
 allow_private_metadata_hosts: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
Expand DownExpand Up@@ -859,17 +863,22 @@ impl AuthorizationManager {
 || (octets[0] == 198 && matches!(octets[1], 18 | 19))
 }

 /// `fe80::/10`, the IPv6 unicast link-local range (`Ipv6Addr::is_unicast_link_local`
 /// is still unstable, so match the prefix directly).
 fn is_ipv6_link_local(addr: Ipv6Addr) -> bool {
 (addr.segments()[0] & 0xffc0) == 0xfe80
 }

 fn is_disallowed_metadata_ipv6(addr: Ipv6Addr) -> bool {
 if let Some(mapped) = addr.to_ipv4_mapped() {
 return Self::is_disallowed_metadata_ipv4(mapped);
 }

 let segments = addr.segments();
 addr.is_loopback()
 || addr.is_unspecified()
 || addr.is_multicast()
 || (segments[0] & 0xffc0) == 0xfe80
 || (segments[0] & 0xfe00) == 0xfc00
 || Self::is_ipv6_link_local(addr)
 || (addr.segments()[0] & 0xfe00) == 0xfc00
 }

 fn is_disallowed_metadata_hostname(host: &str) -> bool {
Expand All@@ -878,24 +887,54 @@ impl AuthorizationManager {
 || CLOUD_METADATA_HOSTS.contains(&host)
 }

 fn is_disallowed_metadata_host(host: &str) -> bool {
 let host = host.trim_end_matches('.').to_ascii_lowercase();
 if Self::is_disallowed_metadata_hostname(&host) {
 return true;
 fn is_disallowed_metadata_host(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => Self::is_disallowed_metadata_hostname(
 &name.trim_end_matches('.').to_ascii_lowercase(),
 ),
 url::Host::Ipv4(addr) => Self::is_disallowed_metadata_ipv4(*addr),
 url::Host::Ipv6(addr) => Self::is_disallowed_metadata_ipv6(*addr),
 }
 }

 match host.parse::<IpAddr>() {
 Ok(IpAddr::V4(addr)) => Self::is_disallowed_metadata_ipv4(addr),
 Ok(IpAddr::V6(addr)) => Self::is_disallowed_metadata_ipv6(addr),
 Err(_) => false,
 /// Hosts that are never a legitimate authorization server and stay rejected
 /// even when private metadata hosts are explicitly allowed: cloud-metadata
 /// service hostnames and link-local addresses (e.g. `169.254.169.254`),
 /// which are the classic SSRF pivots.
 fn is_metadata_ssrf_sink(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => CLOUD_METADATA_HOSTS
 .contains(&name.trim_end_matches('.').to_ascii_lowercase().as_str()),
 url::Host::Ipv4(addr) => addr.is_link_local(),
 // Match the IPv4-mapped form too, so `::ffff:169.254.169.254` can't
 // slip a link-local address past the sink check.
 url::Host::Ipv6(addr) => match addr.to_ipv4_mapped() {
 Some(mapped) => mapped.is_link_local(),
 None => Self::is_ipv6_link_local(*addr),
 },
 }
 }

 fn is_allowed_authorization_server_metadata_url(url: &Url) -> bool {
 Self::is_http_url(url)
 && url
 .host_str()
 .is_some_and(|host| !Self::is_disallowed_metadata_host(host))
 fn is_allowed_authorization_server_metadata_url(&self, url: &Url) -> bool {
 if !Self::is_http_url(url) {
 return false;
 }
 // Use the typed host rather than `host_str()` so IPv6 literals are
 // matched as addresses instead of a bracketed string that never parses.
 let Some(host) = url.host() else {
 return false;
 };
 // Cloud-metadata and link-local hosts are never a valid authorization
 // server; reject them regardless of configuration.
 if Self::is_metadata_ssrf_sink(&host) {
 return false;
 }
 // Loopback and private-network hosts are rejected by default to prevent
 // SSRF, but can be explicitly allowed for local or internal deployments.
 if self.allow_private_metadata_hosts {
 return true;
 }
 !Self::is_disallowed_metadata_host(&host)
 }

 fn resolve_resource_metadata_url(value: &str, base_url: &Url) -> Option<Url> {
Expand DownExpand Up@@ -993,6 +1032,7 @@ impl AuthorizationManager {
 www_auth_scopes: RwLock::new(Vec::new()),
 resource_scopes: RwLock::new(Vec::new()),
 application_type: Some(DEFAULT_APPLICATION_TYPE.to_string()),
 allow_private_metadata_hosts: false,
 };

 Ok(manager)
Expand All@@ -1003,6 +1043,17 @@ impl AuthorizationManager {
 self.scope_upgrade_config = config;
 }

 /// Allow loopback and private-network hosts as authorization servers.
 ///
 /// By default these are rejected to prevent SSRF, which also blocks
 /// legitimate local development (`http://localhost`, `127.0.0.1`) and
 /// internal enterprise deployments (RFC 1918 addresses). Enable this only
 /// when the authorization server is trusted. Cloud-metadata endpoints and
 /// link-local addresses (e.g. `169.254.169.254`) remain blocked either way.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 self.allow_private_metadata_hosts = allow;
 }

 /// Set a custom credential store
 ///
 /// This allows you to provide your own implementation of credential storage,
Expand DownExpand Up@@ -1885,7 +1936,7 @@ impl AuthorizationManager {
 },
 };

 if !Self::is_allowed_authorization_server_metadata_url(&candidate_url) {
 if !self.is_allowed_authorization_server_metadata_url(&candidate_url) {
 warn!("rejecting authorization server metadata URL `{candidate_url}`");
 continue;
 }
Expand DownExpand Up@@ -2849,6 +2900,18 @@ impl OAuthState {
 Ok(OAuthState::Unauthorized(manager))
 }

 /// Allow loopback and private-network authorization server hosts.
 ///
 /// Must be called before authorization begins, while the state is still
 /// unauthorized (metadata discovery is where the host is validated). See
 /// [`AuthorizationManager::set_allow_private_metadata_hosts`] for the
 /// security implications.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 if let OAuthState::Unauthorized(manager) = self {
 manager.set_allow_private_metadata_hosts(allow);
 }
 }

 /// Get client_id and OAuth credentials
 pub async fn get_credentials(&self) -> Result<Credentials, AuthError> {
 // return client_id and credentials
Expand DownExpand Up@@ -3406,6 +3469,57 @@ mod tests {
 );
 }

 async fn metadata_guard_manager(allow_private: bool) -> AuthorizationManager {
 let client = RecordingOAuthHttpClient::with_responses(vec![]);
 let mut manager = AuthorizationManager::new_with_oauth_http_client(
 "https://mcp.example.com/mcp",
 Arc::new(client),
 )
 .await
 .unwrap();
 manager.set_allow_private_metadata_hosts(allow_private);
 manager
 }

 #[tokio::test]
 async fn rejects_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://127.0.0.1:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn allows_private_authorization_server_when_opted_in() {
 let manager = metadata_guard_manager(true).await;
 let loopback = Url::parse("http://127.0.0.1:9000/").unwrap();
 let private = Url::parse("http://10.0.0.5/.well-known/oauth-authorization-server").unwrap();
 assert!(manager.is_allowed_authorization_server_metadata_url(&loopback));
 assert!(manager.is_allowed_authorization_server_metadata_url(&private));
 }

 #[tokio::test]
 async fn rejects_ssrf_sinks_even_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let link_local = Url::parse("http://169.254.169.254/latest/meta-data/").unwrap();
 let cloud_metadata = Url::parse("http://metadata.google.internal/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&link_local));
 assert!(!manager.is_allowed_authorization_server_metadata_url(&cloud_metadata));
 }

 #[tokio::test]
 async fn rejects_ipv4_mapped_link_local_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let mapped = Url::parse("http://[::ffff:169.254.169.254]/latest/meta-data/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&mapped));
 }

 #[tokio::test]
 async fn rejects_ipv6_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://[::1]:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn protected_resource_discovery_rejects_mismatched_resource() {
 let challenge = oauth2::http::Response::builder()
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: allow opting into private oauth metadata hosts#954

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

DaleSeo
wants to merge
2
commits into

from

 Closed


feat: allow opting into private oauth metadata hosts
#954
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
24565e9

feat: allow opting into private oauth metadata hosts


DaleSeo Jul 3, 2026
a341aec

test: opt conformance client into private metadata hosts


DaleSeo Jul 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
conformance/src/bin/client.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -192,6 +192,9 @@ async fn perform_oauth_flow(
 _ctx: &ConformanceContext,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);

 // Discover + register + get auth URL
 oauth
Expand DownExpand Up@@ -242,6 +245,9 @@ async fn perform_oauth_flow_preregistered(
 client_secret: &str,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 manager.set_metadata(metadata);

Expand DownExpand Up@@ -316,6 +322,9 @@ async fn run_auth_scope_step_up_client(
) -> anyhow::Result<()> {
 // First auth
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -368,6 +377,7 @@ async fn run_auth_scope_step_up_client(
 // Re-do the full flow; the server will give us the right scopes
 // on the second authorization request.
 let mut oauth2 = OAuthState::new(server_url, None).await?;
 oauth2.set_allow_private_metadata_hosts(true);
 // Pass the escalated scope hint
 oauth2
 .start_authorization_with_metadata_url(
Expand DownExpand Up@@ -417,6 +427,9 @@ async fn run_auth_scope_retry_limit_client(

 loop {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -524,6 +537,9 @@ async fn run_client_credentials_basic(
 .unwrap_or("conformance-test-secret");

 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand DownExpand Up@@ -582,6 +598,9 @@ async fn run_client_credentials_jwt(

 // Discover metadata to get token endpoint
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand Down

150 changes: 132 additions & 18 deletions
crates/rmcp/src/transport/auth.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
use std::{
 collections::HashMap,
 future::Future,
 net::{IpAddr, Ipv4Addr, Ipv6Addr},
 net::{Ipv4Addr, Ipv6Addr},
 pin::Pin,
 sync::Arc,
 time::{Duration, SystemTime, UNIX_EPOCH},
Expand DownExpand Up@@ -780,6 +780,10 @@ pub struct AuthorizationManager {
 resource_scopes: RwLock<Vec<String>>,
 /// OIDC Dynamic Client Registration `application_type` (SEP-837)
 application_type: Option<String>,
 /// Allow loopback and private-network authorization server metadata hosts.
 /// Off by default to prevent SSRF; opt in for local development or
 /// internal deployments. Cloud-metadata and link-local hosts stay blocked.
 allow_private_metadata_hosts: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
Expand DownExpand Up@@ -859,17 +863,22 @@ impl AuthorizationManager {
 || (octets[0] == 198 && matches!(octets[1], 18 | 19))
 }

 /// `fe80::/10`, the IPv6 unicast link-local range (`Ipv6Addr::is_unicast_link_local`
 /// is still unstable, so match the prefix directly).
 fn is_ipv6_link_local(addr: Ipv6Addr) -> bool {
 (addr.segments()[0] & 0xffc0) == 0xfe80
 }

 fn is_disallowed_metadata_ipv6(addr: Ipv6Addr) -> bool {
 if let Some(mapped) = addr.to_ipv4_mapped() {
 return Self::is_disallowed_metadata_ipv4(mapped);
 }

 let segments = addr.segments();
 addr.is_loopback()
 || addr.is_unspecified()
 || addr.is_multicast()
 || (segments[0] & 0xffc0) == 0xfe80
 || (segments[0] & 0xfe00) == 0xfc00
 || Self::is_ipv6_link_local(addr)
 || (addr.segments()[0] & 0xfe00) == 0xfc00
 }

 fn is_disallowed_metadata_hostname(host: &str) -> bool {
Expand All@@ -878,24 +887,54 @@ impl AuthorizationManager {
 || CLOUD_METADATA_HOSTS.contains(&host)
 }

 fn is_disallowed_metadata_host(host: &str) -> bool {
 let host = host.trim_end_matches('.').to_ascii_lowercase();
 if Self::is_disallowed_metadata_hostname(&host) {
 return true;
 fn is_disallowed_metadata_host(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => Self::is_disallowed_metadata_hostname(
 &name.trim_end_matches('.').to_ascii_lowercase(),
 ),
 url::Host::Ipv4(addr) => Self::is_disallowed_metadata_ipv4(*addr),
 url::Host::Ipv6(addr) => Self::is_disallowed_metadata_ipv6(*addr),
 }
 }

 match host.parse::<IpAddr>() {
 Ok(IpAddr::V4(addr)) => Self::is_disallowed_metadata_ipv4(addr),
 Ok(IpAddr::V6(addr)) => Self::is_disallowed_metadata_ipv6(addr),
 Err(_) => false,
 /// Hosts that are never a legitimate authorization server and stay rejected
 /// even when private metadata hosts are explicitly allowed: cloud-metadata
 /// service hostnames and link-local addresses (e.g. `169.254.169.254`),
 /// which are the classic SSRF pivots.
 fn is_metadata_ssrf_sink(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => CLOUD_METADATA_HOSTS
 .contains(&name.trim_end_matches('.').to_ascii_lowercase().as_str()),
 url::Host::Ipv4(addr) => addr.is_link_local(),
 // Match the IPv4-mapped form too, so `::ffff:169.254.169.254` can't
 // slip a link-local address past the sink check.
 url::Host::Ipv6(addr) => match addr.to_ipv4_mapped() {
 Some(mapped) => mapped.is_link_local(),
 None => Self::is_ipv6_link_local(*addr),
 },
 }
 }

 fn is_allowed_authorization_server_metadata_url(url: &Url) -> bool {
 Self::is_http_url(url)
 && url
 .host_str()
 .is_some_and(|host| !Self::is_disallowed_metadata_host(host))
 fn is_allowed_authorization_server_metadata_url(&self, url: &Url) -> bool {
 if !Self::is_http_url(url) {
 return false;
 }
 // Use the typed host rather than `host_str()` so IPv6 literals are
 // matched as addresses instead of a bracketed string that never parses.
 let Some(host) = url.host() else {
 return false;
 };
 // Cloud-metadata and link-local hosts are never a valid authorization
 // server; reject them regardless of configuration.
 if Self::is_metadata_ssrf_sink(&host) {
 return false;
 }
 // Loopback and private-network hosts are rejected by default to prevent
 // SSRF, but can be explicitly allowed for local or internal deployments.
 if self.allow_private_metadata_hosts {
 return true;
 }
 !Self::is_disallowed_metadata_host(&host)
 }

 fn resolve_resource_metadata_url(value: &str, base_url: &Url) -> Option<Url> {
Expand DownExpand Up@@ -993,6 +1032,7 @@ impl AuthorizationManager {
 www_auth_scopes: RwLock::new(Vec::new()),
 resource_scopes: RwLock::new(Vec::new()),
 application_type: Some(DEFAULT_APPLICATION_TYPE.to_string()),
 allow_private_metadata_hosts: false,
 };

 Ok(manager)
Expand All@@ -1003,6 +1043,17 @@ impl AuthorizationManager {
 self.scope_upgrade_config = config;
 }

 /// Allow loopback and private-network hosts as authorization servers.
 ///
 /// By default these are rejected to prevent SSRF, which also blocks
 /// legitimate local development (`http://localhost`, `127.0.0.1`) and
 /// internal enterprise deployments (RFC 1918 addresses). Enable this only
 /// when the authorization server is trusted. Cloud-metadata endpoints and
 /// link-local addresses (e.g. `169.254.169.254`) remain blocked either way.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 self.allow_private_metadata_hosts = allow;
 }

 /// Set a custom credential store
 ///
 /// This allows you to provide your own implementation of credential storage,
Expand DownExpand Up@@ -1885,7 +1936,7 @@ impl AuthorizationManager {
 },
 };

 if !Self::is_allowed_authorization_server_metadata_url(&candidate_url) {
 if !self.is_allowed_authorization_server_metadata_url(&candidate_url) {
 warn!("rejecting authorization server metadata URL `{candidate_url}`");
 continue;
 }
Expand DownExpand Up@@ -2849,6 +2900,18 @@ impl OAuthState {
 Ok(OAuthState::Unauthorized(manager))
 }

 /// Allow loopback and private-network authorization server hosts.
 ///
 /// Must be called before authorization begins, while the state is still
 /// unauthorized (metadata discovery is where the host is validated). See
 /// [`AuthorizationManager::set_allow_private_metadata_hosts`] for the
 /// security implications.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 if let OAuthState::Unauthorized(manager) = self {
 manager.set_allow_private_metadata_hosts(allow);
 }
 }

 /// Get client_id and OAuth credentials
 pub async fn get_credentials(&self) -> Result<Credentials, AuthError> {
 // return client_id and credentials
Expand DownExpand Up@@ -3406,6 +3469,57 @@ mod tests {
 );
 }

 async fn metadata_guard_manager(allow_private: bool) -> AuthorizationManager {
 let client = RecordingOAuthHttpClient::with_responses(vec![]);
 let mut manager = AuthorizationManager::new_with_oauth_http_client(
 "https://mcp.example.com/mcp",
 Arc::new(client),
 )
 .await
 .unwrap();
 manager.set_allow_private_metadata_hosts(allow_private);
 manager
 }

 #[tokio::test]
 async fn rejects_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://127.0.0.1:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn allows_private_authorization_server_when_opted_in() {
 let manager = metadata_guard_manager(true).await;
 let loopback = Url::parse("http://127.0.0.1:9000/").unwrap();
 let private = Url::parse("http://10.0.0.5/.well-known/oauth-authorization-server").unwrap();
 assert!(manager.is_allowed_authorization_server_metadata_url(&loopback));
 assert!(manager.is_allowed_authorization_server_metadata_url(&private));
 }

 #[tokio::test]
 async fn rejects_ssrf_sinks_even_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let link_local = Url::parse("http://169.254.169.254/latest/meta-data/").unwrap();
 let cloud_metadata = Url::parse("http://metadata.google.internal/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&link_local));
 assert!(!manager.is_allowed_authorization_server_metadata_url(&cloud_metadata));
 }

 #[tokio::test]
 async fn rejects_ipv4_mapped_link_local_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let mapped = Url::parse("http://[::ffff:169.254.169.254]/latest/meta-data/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&mapped));
 }

 #[tokio::test]
 async fn rejects_ipv6_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://[::1]:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn protected_resource_discovery_rejects_mismatched_resource() {
 let challenge = oauth2::http::Response::builder()
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat: allow opting into private oauth metadata hosts#954

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

DaleSeo
wants to merge
2
commits into

from

 Closed


feat: allow opting into private oauth metadata hosts
#954
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
24565e9

feat: allow opting into private oauth metadata hosts


DaleSeo Jul 3, 2026
a341aec

test: opt conformance client into private metadata hosts


DaleSeo Jul 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
conformance/src/bin/client.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -192,6 +192,9 @@ async fn perform_oauth_flow(
 _ctx: &ConformanceContext,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);

 // Discover + register + get auth URL
 oauth
Expand DownExpand Up@@ -242,6 +245,9 @@ async fn perform_oauth_flow_preregistered(
 client_secret: &str,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 manager.set_metadata(metadata);

Expand DownExpand Up@@ -316,6 +322,9 @@ async fn run_auth_scope_step_up_client(
) -> anyhow::Result<()> {
 // First auth
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -368,6 +377,7 @@ async fn run_auth_scope_step_up_client(
 // Re-do the full flow; the server will give us the right scopes
 // on the second authorization request.
 let mut oauth2 = OAuthState::new(server_url, None).await?;
 oauth2.set_allow_private_metadata_hosts(true);
 // Pass the escalated scope hint
 oauth2
 .start_authorization_with_metadata_url(
Expand DownExpand Up@@ -417,6 +427,9 @@ async fn run_auth_scope_retry_limit_client(

 loop {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -524,6 +537,9 @@ async fn run_client_credentials_basic(
 .unwrap_or("conformance-test-secret");

 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand DownExpand Up@@ -582,6 +598,9 @@ async fn run_client_credentials_jwt(

 // Discover metadata to get token endpoint
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand Down

150 changes: 132 additions & 18 deletions
crates/rmcp/src/transport/auth.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
use std::{
 collections::HashMap,
 future::Future,
 net::{IpAddr, Ipv4Addr, Ipv6Addr},
 net::{Ipv4Addr, Ipv6Addr},
 pin::Pin,
 sync::Arc,
 time::{Duration, SystemTime, UNIX_EPOCH},
Expand DownExpand Up@@ -780,6 +780,10 @@ pub struct AuthorizationManager {
 resource_scopes: RwLock<Vec<String>>,
 /// OIDC Dynamic Client Registration `application_type` (SEP-837)
 application_type: Option<String>,
 /// Allow loopback and private-network authorization server metadata hosts.
 /// Off by default to prevent SSRF; opt in for local development or
 /// internal deployments. Cloud-metadata and link-local hosts stay blocked.
 allow_private_metadata_hosts: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
Expand DownExpand Up@@ -859,17 +863,22 @@ impl AuthorizationManager {
 || (octets[0] == 198 && matches!(octets[1], 18 | 19))
 }

 /// `fe80::/10`, the IPv6 unicast link-local range (`Ipv6Addr::is_unicast_link_local`
 /// is still unstable, so match the prefix directly).
 fn is_ipv6_link_local(addr: Ipv6Addr) -> bool {
 (addr.segments()[0] & 0xffc0) == 0xfe80
 }

 fn is_disallowed_metadata_ipv6(addr: Ipv6Addr) -> bool {
 if let Some(mapped) = addr.to_ipv4_mapped() {
 return Self::is_disallowed_metadata_ipv4(mapped);
 }

 let segments = addr.segments();
 addr.is_loopback()
 || addr.is_unspecified()
 || addr.is_multicast()
 || (segments[0] & 0xffc0) == 0xfe80
 || (segments[0] & 0xfe00) == 0xfc00
 || Self::is_ipv6_link_local(addr)
 || (addr.segments()[0] & 0xfe00) == 0xfc00
 }

 fn is_disallowed_metadata_hostname(host: &str) -> bool {
Expand All@@ -878,24 +887,54 @@ impl AuthorizationManager {
 || CLOUD_METADATA_HOSTS.contains(&host)
 }

 fn is_disallowed_metadata_host(host: &str) -> bool {
 let host = host.trim_end_matches('.').to_ascii_lowercase();
 if Self::is_disallowed_metadata_hostname(&host) {
 return true;
 fn is_disallowed_metadata_host(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => Self::is_disallowed_metadata_hostname(
 &name.trim_end_matches('.').to_ascii_lowercase(),
 ),
 url::Host::Ipv4(addr) => Self::is_disallowed_metadata_ipv4(*addr),
 url::Host::Ipv6(addr) => Self::is_disallowed_metadata_ipv6(*addr),
 }
 }

 match host.parse::<IpAddr>() {
 Ok(IpAddr::V4(addr)) => Self::is_disallowed_metadata_ipv4(addr),
 Ok(IpAddr::V6(addr)) => Self::is_disallowed_metadata_ipv6(addr),
 Err(_) => false,
 /// Hosts that are never a legitimate authorization server and stay rejected
 /// even when private metadata hosts are explicitly allowed: cloud-metadata
 /// service hostnames and link-local addresses (e.g. `169.254.169.254`),
 /// which are the classic SSRF pivots.
 fn is_metadata_ssrf_sink(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => CLOUD_METADATA_HOSTS
 .contains(&name.trim_end_matches('.').to_ascii_lowercase().as_str()),
 url::Host::Ipv4(addr) => addr.is_link_local(),
 // Match the IPv4-mapped form too, so `::ffff:169.254.169.254` can't
 // slip a link-local address past the sink check.
 url::Host::Ipv6(addr) => match addr.to_ipv4_mapped() {
 Some(mapped) => mapped.is_link_local(),
 None => Self::is_ipv6_link_local(*addr),
 },
 }
 }

 fn is_allowed_authorization_server_metadata_url(url: &Url) -> bool {
 Self::is_http_url(url)
 && url
 .host_str()
 .is_some_and(|host| !Self::is_disallowed_metadata_host(host))
 fn is_allowed_authorization_server_metadata_url(&self, url: &Url) -> bool {
 if !Self::is_http_url(url) {
 return false;
 }
 // Use the typed host rather than `host_str()` so IPv6 literals are
 // matched as addresses instead of a bracketed string that never parses.
 let Some(host) = url.host() else {
 return false;
 };
 // Cloud-metadata and link-local hosts are never a valid authorization
 // server; reject them regardless of configuration.
 if Self::is_metadata_ssrf_sink(&host) {
 return false;
 }
 // Loopback and private-network hosts are rejected by default to prevent
 // SSRF, but can be explicitly allowed for local or internal deployments.
 if self.allow_private_metadata_hosts {
 return true;
 }
 !Self::is_disallowed_metadata_host(&host)
 }

 fn resolve_resource_metadata_url(value: &str, base_url: &Url) -> Option<Url> {
Expand DownExpand Up@@ -993,6 +1032,7 @@ impl AuthorizationManager {
 www_auth_scopes: RwLock::new(Vec::new()),
 resource_scopes: RwLock::new(Vec::new()),
 application_type: Some(DEFAULT_APPLICATION_TYPE.to_string()),
 allow_private_metadata_hosts: false,
 };

 Ok(manager)
Expand All@@ -1003,6 +1043,17 @@ impl AuthorizationManager {
 self.scope_upgrade_config = config;
 }

 /// Allow loopback and private-network hosts as authorization servers.
 ///
 /// By default these are rejected to prevent SSRF, which also blocks
 /// legitimate local development (`http://localhost`, `127.0.0.1`) and
 /// internal enterprise deployments (RFC 1918 addresses). Enable this only
 /// when the authorization server is trusted. Cloud-metadata endpoints and
 /// link-local addresses (e.g. `169.254.169.254`) remain blocked either way.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 self.allow_private_metadata_hosts = allow;
 }

 /// Set a custom credential store
 ///
 /// This allows you to provide your own implementation of credential storage,
Expand DownExpand Up@@ -1885,7 +1936,7 @@ impl AuthorizationManager {
 },
 };

 if !Self::is_allowed_authorization_server_metadata_url(&candidate_url) {
 if !self.is_allowed_authorization_server_metadata_url(&candidate_url) {
 warn!("rejecting authorization server metadata URL `{candidate_url}`");
 continue;
 }
Expand DownExpand Up@@ -2849,6 +2900,18 @@ impl OAuthState {
 Ok(OAuthState::Unauthorized(manager))
 }

 /// Allow loopback and private-network authorization server hosts.
 ///
 /// Must be called before authorization begins, while the state is still
 /// unauthorized (metadata discovery is where the host is validated). See
 /// [`AuthorizationManager::set_allow_private_metadata_hosts`] for the
 /// security implications.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 if let OAuthState::Unauthorized(manager) = self {
 manager.set_allow_private_metadata_hosts(allow);
 }
 }

 /// Get client_id and OAuth credentials
 pub async fn get_credentials(&self) -> Result<Credentials, AuthError> {
 // return client_id and credentials
Expand DownExpand Up@@ -3406,6 +3469,57 @@ mod tests {
 );
 }

 async fn metadata_guard_manager(allow_private: bool) -> AuthorizationManager {
 let client = RecordingOAuthHttpClient::with_responses(vec![]);
 let mut manager = AuthorizationManager::new_with_oauth_http_client(
 "https://mcp.example.com/mcp",
 Arc::new(client),
 )
 .await
 .unwrap();
 manager.set_allow_private_metadata_hosts(allow_private);
 manager
 }

 #[tokio::test]
 async fn rejects_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://127.0.0.1:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn allows_private_authorization_server_when_opted_in() {
 let manager = metadata_guard_manager(true).await;
 let loopback = Url::parse("http://127.0.0.1:9000/").unwrap();
 let private = Url::parse("http://10.0.0.5/.well-known/oauth-authorization-server").unwrap();
 assert!(manager.is_allowed_authorization_server_metadata_url(&loopback));
 assert!(manager.is_allowed_authorization_server_metadata_url(&private));
 }

 #[tokio::test]
 async fn rejects_ssrf_sinks_even_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let link_local = Url::parse("http://169.254.169.254/latest/meta-data/").unwrap();
 let cloud_metadata = Url::parse("http://metadata.google.internal/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&link_local));
 assert!(!manager.is_allowed_authorization_server_metadata_url(&cloud_metadata));
 }

 #[tokio::test]
 async fn rejects_ipv4_mapped_link_local_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let mapped = Url::parse("http://[::ffff:169.254.169.254]/latest/meta-data/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&mapped));
 }

 #[tokio::test]
 async fn rejects_ipv6_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://[::1]:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn protected_resource_discovery_rejects_mismatched_resource() {
 let challenge = oauth2::http::Response::builder()
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: allow opting into private oauth metadata hosts#954

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

DaleSeo
wants to merge
2
commits into

from

 Closed


feat: allow opting into private oauth metadata hosts
#954
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
24565e9

feat: allow opting into private oauth metadata hosts


DaleSeo Jul 3, 2026
a341aec

test: opt conformance client into private metadata hosts


DaleSeo Jul 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
conformance/src/bin/client.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -192,6 +192,9 @@ async fn perform_oauth_flow(
 _ctx: &ConformanceContext,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);

 // Discover + register + get auth URL
 oauth
Expand DownExpand Up@@ -242,6 +245,9 @@ async fn perform_oauth_flow_preregistered(
 client_secret: &str,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 manager.set_metadata(metadata);

Expand DownExpand Up@@ -316,6 +322,9 @@ async fn run_auth_scope_step_up_client(
) -> anyhow::Result<()> {
 // First auth
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -368,6 +377,7 @@ async fn run_auth_scope_step_up_client(
 // Re-do the full flow; the server will give us the right scopes
 // on the second authorization request.
 let mut oauth2 = OAuthState::new(server_url, None).await?;
 oauth2.set_allow_private_metadata_hosts(true);
 // Pass the escalated scope hint
 oauth2
 .start_authorization_with_metadata_url(
Expand DownExpand Up@@ -417,6 +427,9 @@ async fn run_auth_scope_retry_limit_client(

 loop {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -524,6 +537,9 @@ async fn run_client_credentials_basic(
 .unwrap_or("conformance-test-secret");

 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand DownExpand Up@@ -582,6 +598,9 @@ async fn run_client_credentials_jwt(

 // Discover metadata to get token endpoint
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand Down

150 changes: 132 additions & 18 deletions
crates/rmcp/src/transport/auth.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
use std::{
 collections::HashMap,
 future::Future,
 net::{IpAddr, Ipv4Addr, Ipv6Addr},
 net::{Ipv4Addr, Ipv6Addr},
 pin::Pin,
 sync::Arc,
 time::{Duration, SystemTime, UNIX_EPOCH},
Expand DownExpand Up@@ -780,6 +780,10 @@ pub struct AuthorizationManager {
 resource_scopes: RwLock<Vec<String>>,
 /// OIDC Dynamic Client Registration `application_type` (SEP-837)
 application_type: Option<String>,
 /// Allow loopback and private-network authorization server metadata hosts.
 /// Off by default to prevent SSRF; opt in for local development or
 /// internal deployments. Cloud-metadata and link-local hosts stay blocked.
 allow_private_metadata_hosts: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
Expand DownExpand Up@@ -859,17 +863,22 @@ impl AuthorizationManager {
 || (octets[0] == 198 && matches!(octets[1], 18 | 19))
 }

 /// `fe80::/10`, the IPv6 unicast link-local range (`Ipv6Addr::is_unicast_link_local`
 /// is still unstable, so match the prefix directly).
 fn is_ipv6_link_local(addr: Ipv6Addr) -> bool {
 (addr.segments()[0] & 0xffc0) == 0xfe80
 }

 fn is_disallowed_metadata_ipv6(addr: Ipv6Addr) -> bool {
 if let Some(mapped) = addr.to_ipv4_mapped() {
 return Self::is_disallowed_metadata_ipv4(mapped);
 }

 let segments = addr.segments();
 addr.is_loopback()
 || addr.is_unspecified()
 || addr.is_multicast()
 || (segments[0] & 0xffc0) == 0xfe80
 || (segments[0] & 0xfe00) == 0xfc00
 || Self::is_ipv6_link_local(addr)
 || (addr.segments()[0] & 0xfe00) == 0xfc00
 }

 fn is_disallowed_metadata_hostname(host: &str) -> bool {
Expand All@@ -878,24 +887,54 @@ impl AuthorizationManager {
 || CLOUD_METADATA_HOSTS.contains(&host)
 }

 fn is_disallowed_metadata_host(host: &str) -> bool {
 let host = host.trim_end_matches('.').to_ascii_lowercase();
 if Self::is_disallowed_metadata_hostname(&host) {
 return true;
 fn is_disallowed_metadata_host(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => Self::is_disallowed_metadata_hostname(
 &name.trim_end_matches('.').to_ascii_lowercase(),
 ),
 url::Host::Ipv4(addr) => Self::is_disallowed_metadata_ipv4(*addr),
 url::Host::Ipv6(addr) => Self::is_disallowed_metadata_ipv6(*addr),
 }
 }

 match host.parse::<IpAddr>() {
 Ok(IpAddr::V4(addr)) => Self::is_disallowed_metadata_ipv4(addr),
 Ok(IpAddr::V6(addr)) => Self::is_disallowed_metadata_ipv6(addr),
 Err(_) => false,
 /// Hosts that are never a legitimate authorization server and stay rejected
 /// even when private metadata hosts are explicitly allowed: cloud-metadata
 /// service hostnames and link-local addresses (e.g. `169.254.169.254`),
 /// which are the classic SSRF pivots.
 fn is_metadata_ssrf_sink(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => CLOUD_METADATA_HOSTS
 .contains(&name.trim_end_matches('.').to_ascii_lowercase().as_str()),
 url::Host::Ipv4(addr) => addr.is_link_local(),
 // Match the IPv4-mapped form too, so `::ffff:169.254.169.254` can't
 // slip a link-local address past the sink check.
 url::Host::Ipv6(addr) => match addr.to_ipv4_mapped() {
 Some(mapped) => mapped.is_link_local(),
 None => Self::is_ipv6_link_local(*addr),
 },
 }
 }

 fn is_allowed_authorization_server_metadata_url(url: &Url) -> bool {
 Self::is_http_url(url)
 && url
 .host_str()
 .is_some_and(|host| !Self::is_disallowed_metadata_host(host))
 fn is_allowed_authorization_server_metadata_url(&self, url: &Url) -> bool {
 if !Self::is_http_url(url) {
 return false;
 }
 // Use the typed host rather than `host_str()` so IPv6 literals are
 // matched as addresses instead of a bracketed string that never parses.
 let Some(host) = url.host() else {
 return false;
 };
 // Cloud-metadata and link-local hosts are never a valid authorization
 // server; reject them regardless of configuration.
 if Self::is_metadata_ssrf_sink(&host) {
 return false;
 }
 // Loopback and private-network hosts are rejected by default to prevent
 // SSRF, but can be explicitly allowed for local or internal deployments.
 if self.allow_private_metadata_hosts {
 return true;
 }
 !Self::is_disallowed_metadata_host(&host)
 }

 fn resolve_resource_metadata_url(value: &str, base_url: &Url) -> Option<Url> {
Expand DownExpand Up@@ -993,6 +1032,7 @@ impl AuthorizationManager {
 www_auth_scopes: RwLock::new(Vec::new()),
 resource_scopes: RwLock::new(Vec::new()),
 application_type: Some(DEFAULT_APPLICATION_TYPE.to_string()),
 allow_private_metadata_hosts: false,
 };

 Ok(manager)
Expand All@@ -1003,6 +1043,17 @@ impl AuthorizationManager {
 self.scope_upgrade_config = config;
 }

 /// Allow loopback and private-network hosts as authorization servers.
 ///
 /// By default these are rejected to prevent SSRF, which also blocks
 /// legitimate local development (`http://localhost`, `127.0.0.1`) and
 /// internal enterprise deployments (RFC 1918 addresses). Enable this only
 /// when the authorization server is trusted. Cloud-metadata endpoints and
 /// link-local addresses (e.g. `169.254.169.254`) remain blocked either way.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 self.allow_private_metadata_hosts = allow;
 }

 /// Set a custom credential store
 ///
 /// This allows you to provide your own implementation of credential storage,
Expand DownExpand Up@@ -1885,7 +1936,7 @@ impl AuthorizationManager {
 },
 };

 if !Self::is_allowed_authorization_server_metadata_url(&candidate_url) {
 if !self.is_allowed_authorization_server_metadata_url(&candidate_url) {
 warn!("rejecting authorization server metadata URL `{candidate_url}`");
 continue;
 }
Expand DownExpand Up@@ -2849,6 +2900,18 @@ impl OAuthState {
 Ok(OAuthState::Unauthorized(manager))
 }

 /// Allow loopback and private-network authorization server hosts.
 ///
 /// Must be called before authorization begins, while the state is still
 /// unauthorized (metadata discovery is where the host is validated). See
 /// [`AuthorizationManager::set_allow_private_metadata_hosts`] for the
 /// security implications.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 if let OAuthState::Unauthorized(manager) = self {
 manager.set_allow_private_metadata_hosts(allow);
 }
 }

 /// Get client_id and OAuth credentials
 pub async fn get_credentials(&self) -> Result<Credentials, AuthError> {
 // return client_id and credentials
Expand DownExpand Up@@ -3406,6 +3469,57 @@ mod tests {
 );
 }

 async fn metadata_guard_manager(allow_private: bool) -> AuthorizationManager {
 let client = RecordingOAuthHttpClient::with_responses(vec![]);
 let mut manager = AuthorizationManager::new_with_oauth_http_client(
 "https://mcp.example.com/mcp",
 Arc::new(client),
 )
 .await
 .unwrap();
 manager.set_allow_private_metadata_hosts(allow_private);
 manager
 }

 #[tokio::test]
 async fn rejects_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://127.0.0.1:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn allows_private_authorization_server_when_opted_in() {
 let manager = metadata_guard_manager(true).await;
 let loopback = Url::parse("http://127.0.0.1:9000/").unwrap();
 let private = Url::parse("http://10.0.0.5/.well-known/oauth-authorization-server").unwrap();
 assert!(manager.is_allowed_authorization_server_metadata_url(&loopback));
 assert!(manager.is_allowed_authorization_server_metadata_url(&private));
 }

 #[tokio::test]
 async fn rejects_ssrf_sinks_even_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let link_local = Url::parse("http://169.254.169.254/latest/meta-data/").unwrap();
 let cloud_metadata = Url::parse("http://metadata.google.internal/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&link_local));
 assert!(!manager.is_allowed_authorization_server_metadata_url(&cloud_metadata));
 }

 #[tokio::test]
 async fn rejects_ipv4_mapped_link_local_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let mapped = Url::parse("http://[::ffff:169.254.169.254]/latest/meta-data/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&mapped));
 }

 #[tokio::test]
 async fn rejects_ipv6_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://[::1]:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn protected_resource_discovery_rejects_mismatched_resource() {
 let challenge = oauth2::http::Response::builder()
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: allow opting into private oauth metadata hosts#954

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

DaleSeo
wants to merge
2
commits into

from

 Closed


feat: allow opting into private oauth metadata hosts
#954
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
24565e9

feat: allow opting into private oauth metadata hosts


DaleSeo Jul 3, 2026
a341aec

test: opt conformance client into private metadata hosts


DaleSeo Jul 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
conformance/src/bin/client.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -192,6 +192,9 @@ async fn perform_oauth_flow(
 _ctx: &ConformanceContext,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);

 // Discover + register + get auth URL
 oauth
Expand DownExpand Up@@ -242,6 +245,9 @@ async fn perform_oauth_flow_preregistered(
 client_secret: &str,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 manager.set_metadata(metadata);

Expand DownExpand Up@@ -316,6 +322,9 @@ async fn run_auth_scope_step_up_client(
) -> anyhow::Result<()> {
 // First auth
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -368,6 +377,7 @@ async fn run_auth_scope_step_up_client(
 // Re-do the full flow; the server will give us the right scopes
 // on the second authorization request.
 let mut oauth2 = OAuthState::new(server_url, None).await?;
 oauth2.set_allow_private_metadata_hosts(true);
 // Pass the escalated scope hint
 oauth2
 .start_authorization_with_metadata_url(
Expand DownExpand Up@@ -417,6 +427,9 @@ async fn run_auth_scope_retry_limit_client(

 loop {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -524,6 +537,9 @@ async fn run_client_credentials_basic(
 .unwrap_or("conformance-test-secret");

 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand DownExpand Up@@ -582,6 +598,9 @@ async fn run_client_credentials_jwt(

 // Discover metadata to get token endpoint
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand Down

150 changes: 132 additions & 18 deletions
crates/rmcp/src/transport/auth.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
use std::{
 collections::HashMap,
 future::Future,
 net::{IpAddr, Ipv4Addr, Ipv6Addr},
 net::{Ipv4Addr, Ipv6Addr},
 pin::Pin,
 sync::Arc,
 time::{Duration, SystemTime, UNIX_EPOCH},
Expand DownExpand Up@@ -780,6 +780,10 @@ pub struct AuthorizationManager {
 resource_scopes: RwLock<Vec<String>>,
 /// OIDC Dynamic Client Registration `application_type` (SEP-837)
 application_type: Option<String>,
 /// Allow loopback and private-network authorization server metadata hosts.
 /// Off by default to prevent SSRF; opt in for local development or
 /// internal deployments. Cloud-metadata and link-local hosts stay blocked.
 allow_private_metadata_hosts: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
Expand DownExpand Up@@ -859,17 +863,22 @@ impl AuthorizationManager {
 || (octets[0] == 198 && matches!(octets[1], 18 | 19))
 }

 /// `fe80::/10`, the IPv6 unicast link-local range (`Ipv6Addr::is_unicast_link_local`
 /// is still unstable, so match the prefix directly).
 fn is_ipv6_link_local(addr: Ipv6Addr) -> bool {
 (addr.segments()[0] & 0xffc0) == 0xfe80
 }

 fn is_disallowed_metadata_ipv6(addr: Ipv6Addr) -> bool {
 if let Some(mapped) = addr.to_ipv4_mapped() {
 return Self::is_disallowed_metadata_ipv4(mapped);
 }

 let segments = addr.segments();
 addr.is_loopback()
 || addr.is_unspecified()
 || addr.is_multicast()
 || (segments[0] & 0xffc0) == 0xfe80
 || (segments[0] & 0xfe00) == 0xfc00
 || Self::is_ipv6_link_local(addr)
 || (addr.segments()[0] & 0xfe00) == 0xfc00
 }

 fn is_disallowed_metadata_hostname(host: &str) -> bool {
Expand All@@ -878,24 +887,54 @@ impl AuthorizationManager {
 || CLOUD_METADATA_HOSTS.contains(&host)
 }

 fn is_disallowed_metadata_host(host: &str) -> bool {
 let host = host.trim_end_matches('.').to_ascii_lowercase();
 if Self::is_disallowed_metadata_hostname(&host) {
 return true;
 fn is_disallowed_metadata_host(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => Self::is_disallowed_metadata_hostname(
 &name.trim_end_matches('.').to_ascii_lowercase(),
 ),
 url::Host::Ipv4(addr) => Self::is_disallowed_metadata_ipv4(*addr),
 url::Host::Ipv6(addr) => Self::is_disallowed_metadata_ipv6(*addr),
 }
 }

 match host.parse::<IpAddr>() {
 Ok(IpAddr::V4(addr)) => Self::is_disallowed_metadata_ipv4(addr),
 Ok(IpAddr::V6(addr)) => Self::is_disallowed_metadata_ipv6(addr),
 Err(_) => false,
 /// Hosts that are never a legitimate authorization server and stay rejected
 /// even when private metadata hosts are explicitly allowed: cloud-metadata
 /// service hostnames and link-local addresses (e.g. `169.254.169.254`),
 /// which are the classic SSRF pivots.
 fn is_metadata_ssrf_sink(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => CLOUD_METADATA_HOSTS
 .contains(&name.trim_end_matches('.').to_ascii_lowercase().as_str()),
 url::Host::Ipv4(addr) => addr.is_link_local(),
 // Match the IPv4-mapped form too, so `::ffff:169.254.169.254` can't
 // slip a link-local address past the sink check.
 url::Host::Ipv6(addr) => match addr.to_ipv4_mapped() {
 Some(mapped) => mapped.is_link_local(),
 None => Self::is_ipv6_link_local(*addr),
 },
 }
 }

 fn is_allowed_authorization_server_metadata_url(url: &Url) -> bool {
 Self::is_http_url(url)
 && url
 .host_str()
 .is_some_and(|host| !Self::is_disallowed_metadata_host(host))
 fn is_allowed_authorization_server_metadata_url(&self, url: &Url) -> bool {
 if !Self::is_http_url(url) {
 return false;
 }
 // Use the typed host rather than `host_str()` so IPv6 literals are
 // matched as addresses instead of a bracketed string that never parses.
 let Some(host) = url.host() else {
 return false;
 };
 // Cloud-metadata and link-local hosts are never a valid authorization
 // server; reject them regardless of configuration.
 if Self::is_metadata_ssrf_sink(&host) {
 return false;
 }
 // Loopback and private-network hosts are rejected by default to prevent
 // SSRF, but can be explicitly allowed for local or internal deployments.
 if self.allow_private_metadata_hosts {
 return true;
 }
 !Self::is_disallowed_metadata_host(&host)
 }

 fn resolve_resource_metadata_url(value: &str, base_url: &Url) -> Option<Url> {
Expand DownExpand Up@@ -993,6 +1032,7 @@ impl AuthorizationManager {
 www_auth_scopes: RwLock::new(Vec::new()),
 resource_scopes: RwLock::new(Vec::new()),
 application_type: Some(DEFAULT_APPLICATION_TYPE.to_string()),
 allow_private_metadata_hosts: false,
 };

 Ok(manager)
Expand All@@ -1003,6 +1043,17 @@ impl AuthorizationManager {
 self.scope_upgrade_config = config;
 }

 /// Allow loopback and private-network hosts as authorization servers.
 ///
 /// By default these are rejected to prevent SSRF, which also blocks
 /// legitimate local development (`http://localhost`, `127.0.0.1`) and
 /// internal enterprise deployments (RFC 1918 addresses). Enable this only
 /// when the authorization server is trusted. Cloud-metadata endpoints and
 /// link-local addresses (e.g. `169.254.169.254`) remain blocked either way.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 self.allow_private_metadata_hosts = allow;
 }

 /// Set a custom credential store
 ///
 /// This allows you to provide your own implementation of credential storage,
Expand DownExpand Up@@ -1885,7 +1936,7 @@ impl AuthorizationManager {
 },
 };

 if !Self::is_allowed_authorization_server_metadata_url(&candidate_url) {
 if !self.is_allowed_authorization_server_metadata_url(&candidate_url) {
 warn!("rejecting authorization server metadata URL `{candidate_url}`");
 continue;
 }
Expand DownExpand Up@@ -2849,6 +2900,18 @@ impl OAuthState {
 Ok(OAuthState::Unauthorized(manager))
 }

 /// Allow loopback and private-network authorization server hosts.
 ///
 /// Must be called before authorization begins, while the state is still
 /// unauthorized (metadata discovery is where the host is validated). See
 /// [`AuthorizationManager::set_allow_private_metadata_hosts`] for the
 /// security implications.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 if let OAuthState::Unauthorized(manager) = self {
 manager.set_allow_private_metadata_hosts(allow);
 }
 }

 /// Get client_id and OAuth credentials
 pub async fn get_credentials(&self) -> Result<Credentials, AuthError> {
 // return client_id and credentials
Expand DownExpand Up@@ -3406,6 +3469,57 @@ mod tests {
 );
 }

 async fn metadata_guard_manager(allow_private: bool) -> AuthorizationManager {
 let client = RecordingOAuthHttpClient::with_responses(vec![]);
 let mut manager = AuthorizationManager::new_with_oauth_http_client(
 "https://mcp.example.com/mcp",
 Arc::new(client),
 )
 .await
 .unwrap();
 manager.set_allow_private_metadata_hosts(allow_private);
 manager
 }

 #[tokio::test]
 async fn rejects_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://127.0.0.1:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn allows_private_authorization_server_when_opted_in() {
 let manager = metadata_guard_manager(true).await;
 let loopback = Url::parse("http://127.0.0.1:9000/").unwrap();
 let private = Url::parse("http://10.0.0.5/.well-known/oauth-authorization-server").unwrap();
 assert!(manager.is_allowed_authorization_server_metadata_url(&loopback));
 assert!(manager.is_allowed_authorization_server_metadata_url(&private));
 }

 #[tokio::test]
 async fn rejects_ssrf_sinks_even_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let link_local = Url::parse("http://169.254.169.254/latest/meta-data/").unwrap();
 let cloud_metadata = Url::parse("http://metadata.google.internal/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&link_local));
 assert!(!manager.is_allowed_authorization_server_metadata_url(&cloud_metadata));
 }

 #[tokio::test]
 async fn rejects_ipv4_mapped_link_local_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let mapped = Url::parse("http://[::ffff:169.254.169.254]/latest/meta-data/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&mapped));
 }

 #[tokio::test]
 async fn rejects_ipv6_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://[::1]:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn protected_resource_discovery_rejects_mismatched_resource() {
 let challenge = oauth2::http::Response::builder()
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat: allow opting into private oauth metadata hosts#954

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

DaleSeo
wants to merge
2
commits into

from

 Closed


feat: allow opting into private oauth metadata hosts
#954
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
24565e9

feat: allow opting into private oauth metadata hosts


DaleSeo Jul 3, 2026
a341aec

test: opt conformance client into private metadata hosts


DaleSeo Jul 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
conformance/src/bin/client.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -192,6 +192,9 @@ async fn perform_oauth_flow(
 _ctx: &ConformanceContext,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);

 // Discover + register + get auth URL
 oauth
Expand DownExpand Up@@ -242,6 +245,9 @@ async fn perform_oauth_flow_preregistered(
 client_secret: &str,
) -> anyhow::Result<AuthClient<reqwest::Client>> {
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 manager.set_metadata(metadata);

Expand DownExpand Up@@ -316,6 +322,9 @@ async fn run_auth_scope_step_up_client(
) -> anyhow::Result<()> {
 // First auth
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -368,6 +377,7 @@ async fn run_auth_scope_step_up_client(
 // Re-do the full flow; the server will give us the right scopes
 // on the second authorization request.
 let mut oauth2 = OAuthState::new(server_url, None).await?;
 oauth2.set_allow_private_metadata_hosts(true);
 // Pass the escalated scope hint
 oauth2
 .start_authorization_with_metadata_url(
Expand DownExpand Up@@ -417,6 +427,9 @@ async fn run_auth_scope_retry_limit_client(

 loop {
 let mut oauth = OAuthState::new(server_url, None).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 oauth.set_allow_private_metadata_hosts(true);
 oauth
 .start_authorization_with_metadata_url(
 &[],
Expand DownExpand Up@@ -524,6 +537,9 @@ async fn run_client_credentials_basic(
 .unwrap_or("conformance-test-secret");

 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand DownExpand Up@@ -582,6 +598,9 @@ async fn run_client_credentials_jwt(

 // Discover metadata to get token endpoint
 let mut manager = AuthorizationManager::new(server_url).await?;
 // The conformance authorization server runs on loopback; opt in so metadata
 // discovery is not blocked by the SSRF guard.
 manager.set_allow_private_metadata_hosts(true);
 let metadata = manager.discover_metadata().await?;
 let token_endpoint = metadata.token_endpoint.clone();
 manager.set_metadata(metadata);
Expand Down

150 changes: 132 additions & 18 deletions
crates/rmcp/src/transport/auth.rs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
use std::{
 collections::HashMap,
 future::Future,
 net::{IpAddr, Ipv4Addr, Ipv6Addr},
 net::{Ipv4Addr, Ipv6Addr},
 pin::Pin,
 sync::Arc,
 time::{Duration, SystemTime, UNIX_EPOCH},
Expand DownExpand Up@@ -780,6 +780,10 @@ pub struct AuthorizationManager {
 resource_scopes: RwLock<Vec<String>>,
 /// OIDC Dynamic Client Registration `application_type` (SEP-837)
 application_type: Option<String>,
 /// Allow loopback and private-network authorization server metadata hosts.
 /// Off by default to prevent SSRF; opt in for local development or
 /// internal deployments. Cloud-metadata and link-local hosts stay blocked.
 allow_private_metadata_hosts: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
Expand DownExpand Up@@ -859,17 +863,22 @@ impl AuthorizationManager {
 || (octets[0] == 198 && matches!(octets[1], 18 | 19))
 }

 /// `fe80::/10`, the IPv6 unicast link-local range (`Ipv6Addr::is_unicast_link_local`
 /// is still unstable, so match the prefix directly).
 fn is_ipv6_link_local(addr: Ipv6Addr) -> bool {
 (addr.segments()[0] & 0xffc0) == 0xfe80
 }

 fn is_disallowed_metadata_ipv6(addr: Ipv6Addr) -> bool {
 if let Some(mapped) = addr.to_ipv4_mapped() {
 return Self::is_disallowed_metadata_ipv4(mapped);
 }

 let segments = addr.segments();
 addr.is_loopback()
 || addr.is_unspecified()
 || addr.is_multicast()
 || (segments[0] & 0xffc0) == 0xfe80
 || (segments[0] & 0xfe00) == 0xfc00
 || Self::is_ipv6_link_local(addr)
 || (addr.segments()[0] & 0xfe00) == 0xfc00
 }

 fn is_disallowed_metadata_hostname(host: &str) -> bool {
Expand All@@ -878,24 +887,54 @@ impl AuthorizationManager {
 || CLOUD_METADATA_HOSTS.contains(&host)
 }

 fn is_disallowed_metadata_host(host: &str) -> bool {
 let host = host.trim_end_matches('.').to_ascii_lowercase();
 if Self::is_disallowed_metadata_hostname(&host) {
 return true;
 fn is_disallowed_metadata_host(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => Self::is_disallowed_metadata_hostname(
 &name.trim_end_matches('.').to_ascii_lowercase(),
 ),
 url::Host::Ipv4(addr) => Self::is_disallowed_metadata_ipv4(*addr),
 url::Host::Ipv6(addr) => Self::is_disallowed_metadata_ipv6(*addr),
 }
 }

 match host.parse::<IpAddr>() {
 Ok(IpAddr::V4(addr)) => Self::is_disallowed_metadata_ipv4(addr),
 Ok(IpAddr::V6(addr)) => Self::is_disallowed_metadata_ipv6(addr),
 Err(_) => false,
 /// Hosts that are never a legitimate authorization server and stay rejected
 /// even when private metadata hosts are explicitly allowed: cloud-metadata
 /// service hostnames and link-local addresses (e.g. `169.254.169.254`),
 /// which are the classic SSRF pivots.
 fn is_metadata_ssrf_sink(host: &url::Host<&str>) -> bool {
 match host {
 url::Host::Domain(name) => CLOUD_METADATA_HOSTS
 .contains(&name.trim_end_matches('.').to_ascii_lowercase().as_str()),
 url::Host::Ipv4(addr) => addr.is_link_local(),
 // Match the IPv4-mapped form too, so `::ffff:169.254.169.254` can't
 // slip a link-local address past the sink check.
 url::Host::Ipv6(addr) => match addr.to_ipv4_mapped() {
 Some(mapped) => mapped.is_link_local(),
 None => Self::is_ipv6_link_local(*addr),
 },
 }
 }

 fn is_allowed_authorization_server_metadata_url(url: &Url) -> bool {
 Self::is_http_url(url)
 && url
 .host_str()
 .is_some_and(|host| !Self::is_disallowed_metadata_host(host))
 fn is_allowed_authorization_server_metadata_url(&self, url: &Url) -> bool {
 if !Self::is_http_url(url) {
 return false;
 }
 // Use the typed host rather than `host_str()` so IPv6 literals are
 // matched as addresses instead of a bracketed string that never parses.
 let Some(host) = url.host() else {
 return false;
 };
 // Cloud-metadata and link-local hosts are never a valid authorization
 // server; reject them regardless of configuration.
 if Self::is_metadata_ssrf_sink(&host) {
 return false;
 }
 // Loopback and private-network hosts are rejected by default to prevent
 // SSRF, but can be explicitly allowed for local or internal deployments.
 if self.allow_private_metadata_hosts {
 return true;
 }
 !Self::is_disallowed_metadata_host(&host)
 }

 fn resolve_resource_metadata_url(value: &str, base_url: &Url) -> Option<Url> {
Expand DownExpand Up@@ -993,6 +1032,7 @@ impl AuthorizationManager {
 www_auth_scopes: RwLock::new(Vec::new()),
 resource_scopes: RwLock::new(Vec::new()),
 application_type: Some(DEFAULT_APPLICATION_TYPE.to_string()),
 allow_private_metadata_hosts: false,
 };

 Ok(manager)
Expand All@@ -1003,6 +1043,17 @@ impl AuthorizationManager {
 self.scope_upgrade_config = config;
 }

 /// Allow loopback and private-network hosts as authorization servers.
 ///
 /// By default these are rejected to prevent SSRF, which also blocks
 /// legitimate local development (`http://localhost`, `127.0.0.1`) and
 /// internal enterprise deployments (RFC 1918 addresses). Enable this only
 /// when the authorization server is trusted. Cloud-metadata endpoints and
 /// link-local addresses (e.g. `169.254.169.254`) remain blocked either way.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 self.allow_private_metadata_hosts = allow;
 }

 /// Set a custom credential store
 ///
 /// This allows you to provide your own implementation of credential storage,
Expand DownExpand Up@@ -1885,7 +1936,7 @@ impl AuthorizationManager {
 },
 };

 if !Self::is_allowed_authorization_server_metadata_url(&candidate_url) {
 if !self.is_allowed_authorization_server_metadata_url(&candidate_url) {
 warn!("rejecting authorization server metadata URL `{candidate_url}`");
 continue;
 }
Expand DownExpand Up@@ -2849,6 +2900,18 @@ impl OAuthState {
 Ok(OAuthState::Unauthorized(manager))
 }

 /// Allow loopback and private-network authorization server hosts.
 ///
 /// Must be called before authorization begins, while the state is still
 /// unauthorized (metadata discovery is where the host is validated). See
 /// [`AuthorizationManager::set_allow_private_metadata_hosts`] for the
 /// security implications.
 pub fn set_allow_private_metadata_hosts(&mut self, allow: bool) {
 if let OAuthState::Unauthorized(manager) = self {
 manager.set_allow_private_metadata_hosts(allow);
 }
 }

 /// Get client_id and OAuth credentials
 pub async fn get_credentials(&self) -> Result<Credentials, AuthError> {
 // return client_id and credentials
Expand DownExpand Up@@ -3406,6 +3469,57 @@ mod tests {
 );
 }

 async fn metadata_guard_manager(allow_private: bool) -> AuthorizationManager {
 let client = RecordingOAuthHttpClient::with_responses(vec![]);
 let mut manager = AuthorizationManager::new_with_oauth_http_client(
 "https://mcp.example.com/mcp",
 Arc::new(client),
 )
 .await
 .unwrap();
 manager.set_allow_private_metadata_hosts(allow_private);
 manager
 }

 #[tokio::test]
 async fn rejects_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://127.0.0.1:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn allows_private_authorization_server_when_opted_in() {
 let manager = metadata_guard_manager(true).await;
 let loopback = Url::parse("http://127.0.0.1:9000/").unwrap();
 let private = Url::parse("http://10.0.0.5/.well-known/oauth-authorization-server").unwrap();
 assert!(manager.is_allowed_authorization_server_metadata_url(&loopback));
 assert!(manager.is_allowed_authorization_server_metadata_url(&private));
 }

 #[tokio::test]
 async fn rejects_ssrf_sinks_even_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let link_local = Url::parse("http://169.254.169.254/latest/meta-data/").unwrap();
 let cloud_metadata = Url::parse("http://metadata.google.internal/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&link_local));
 assert!(!manager.is_allowed_authorization_server_metadata_url(&cloud_metadata));
 }

 #[tokio::test]
 async fn rejects_ipv4_mapped_link_local_when_private_hosts_allowed() {
 let manager = metadata_guard_manager(true).await;
 let mapped = Url::parse("http://[::ffff:169.254.169.254]/latest/meta-data/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&mapped));
 }

 #[tokio::test]
 async fn rejects_ipv6_loopback_authorization_server_by_default() {
 let manager = metadata_guard_manager(false).await;
 let url = Url::parse("http://[::1]:9000/").unwrap();
 assert!(!manager.is_allowed_authorization_server_metadata_url(&url));
 }

 #[tokio::test]
 async fn protected_resource_discovery_rejects_mismatched_resource() {
 let challenge = oauth2::http::Response::builder()
Expand Down