Skip to content

Commit 40f61d8

Browse files
ochafikochafik
committed
show how to enable strict resource checking in mcp server
1 parent 515abb4 commit 40f61d8

File tree

5 files changed

+48
-14
lines changed

5 files changed

+48
-14
lines changed

‎src/examples/server/demoInMemoryOAuthProvider.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,8 @@ export class DemoInMemoryAuthProvider implements OAuthServerProvider {
4141
if (mcpServerUrl) {
4242
const expectedResource = resourceUrlFromServerUrl(mcpServerUrl);
4343
this.validateResource = (resource?: URL) => {
44-
return !resource || resource.toString() !== expectedResource.toString();
44+
if (!resource) return false;
45+
return resource.toString() === expectedResource.toString();
4546
};
4647
}
4748
}

‎src/examples/server/simpleStreamableHttp.ts‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,13 @@ import { OAuthMetadata } from 'src/shared/auth.js';
1212

1313
// Check for OAuth flag
1414
const useOAuth = process.argv.includes('--oauth');
15+
// Resource Indicator the OAuth tokens are checked against (RFC8707).
16+
const expectedOAuthResource = (iArg => iArg < 0 ? undefined: process.argv[iArg + 1])(process.argv.indexOf('--oauth-resource'));
17+
// Requires Resource Indicator check (implies protocol more recent than 2025-03-26)
18+
const strictOAuthResourceCheck = process.argv.includes('--oauth-resource-strict');
19+
if (strictOAuthResourceCheck && !expectedOAuthResource) {
20+
throw new Error(`Strict resource indicator checking requires passing the expected resource with --oauth-resource https://...`);
21+
}
1522

1623
// Create an MCP server with implementation details
1724
const getServer = () => {
@@ -285,7 +292,7 @@ if (useOAuth) {
285292
const oauthMetadata: OAuthMetadata = setupAuthServer(authServerUrl, mcpServerUrl);
286293

287294
const tokenVerifier = {
288-
verifyAccessToken: async (token: string) => {
295+
verifyAccessToken: async (token: string, protocolVersion: string) => {
289296
const endpoint = oauthMetadata.introspection_endpoint;
290297

291298
if (!endpoint) {
@@ -308,6 +315,15 @@ if (useOAuth) {
308315
}
309316

310317
const data = await response.json();
318+
319+
if (expectedOAuthResource) {
320+
if (strictOAuthResourceCheck && !data.resource) {
321+
throw new Error('Resource Indicator (RFC8707) missing');
322+
}
323+
if (data.resource && data.resource !== expectedOAuthResource) {
324+
throw new Error(`Expected resource indicator ${expectedOAuthResource}, got: ${data.resource}`);
325+
}
326+
}
311327

312328
// Convert the response to AuthInfo format
313329
return {

‎src/server/auth/middleware/bearerAuth.test.ts‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ import { requireBearerAuth } from "./bearerAuth.js";
33
import { AuthInfo } from "../types.js";
44
import { InsufficientScopeError, InvalidTokenError, OAuthError, ServerError } from "../errors.js";
55
import { OAuthTokenVerifier } from "../provider.js";
6+
import { LATEST_PROTOCOL_VERSION } from '../../../types.js';
67

78
// Mock verifier
89
const mockVerifyAccessToken = jest.fn();
@@ -42,12 +43,13 @@ describe("requireBearerAuth middleware", () => {
4243

4344
mockRequest.headers = {
4445
authorization: "Bearer valid-token",
46+
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
4547
};
4648

4749
const middleware = requireBearerAuth({ verifier: mockVerifier });
4850
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
4951

50-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
52+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
5153
expect(mockRequest.auth).toEqual(validAuthInfo);
5254
expect(nextFunction).toHaveBeenCalled();
5355
expect(mockResponse.status).not.toHaveBeenCalled();
@@ -65,12 +67,13 @@ describe("requireBearerAuth middleware", () => {
6567

6668
mockRequest.headers = {
6769
authorization: "Bearer expired-token",
70+
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
6871
};
6972

7073
const middleware = requireBearerAuth({ verifier: mockVerifier });
7174
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
7275

73-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("expired-token");
76+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("expired-token", LATEST_PROTOCOL_VERSION);
7477
expect(mockResponse.status).toHaveBeenCalledWith(401);
7578
expect(mockResponse.set).toHaveBeenCalledWith(
7679
"WWW-Authenticate",
@@ -93,12 +96,13 @@ describe("requireBearerAuth middleware", () => {
9396

9497
mockRequest.headers = {
9598
authorization: "Bearer valid-token",
99+
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
96100
};
97101

98102
const middleware = requireBearerAuth({ verifier: mockVerifier });
99103
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
100104

101-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
105+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
102106
expect(mockRequest.auth).toEqual(nonExpiredAuthInfo);
103107
expect(nextFunction).toHaveBeenCalled();
104108
expect(mockResponse.status).not.toHaveBeenCalled();
@@ -115,6 +119,7 @@ describe("requireBearerAuth middleware", () => {
115119

116120
mockRequest.headers = {
117121
authorization: "Bearer valid-token",
122+
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
118123
};
119124

120125
const middleware = requireBearerAuth({
@@ -124,7 +129,7 @@ describe("requireBearerAuth middleware", () => {
124129

125130
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
126131

127-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
132+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
128133
expect(mockResponse.status).toHaveBeenCalledWith(403);
129134
expect(mockResponse.set).toHaveBeenCalledWith(
130135
"WWW-Authenticate",
@@ -146,6 +151,7 @@ describe("requireBearerAuth middleware", () => {
146151

147152
mockRequest.headers = {
148153
authorization: "Bearer valid-token",
154+
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
149155
};
150156

151157
const middleware = requireBearerAuth({
@@ -155,7 +161,7 @@ describe("requireBearerAuth middleware", () => {
155161

156162
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
157163

158-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
164+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
159165
expect(mockRequest.auth).toEqual(authInfo);
160166
expect(nextFunction).toHaveBeenCalled();
161167
expect(mockResponse.status).not.toHaveBeenCalled();
@@ -204,14 +210,15 @@ describe("requireBearerAuth middleware", () => {
204210
it("should return 401 when token verification fails with InvalidTokenError", async () => {
205211
mockRequest.headers = {
206212
authorization: "Bearer invalid-token",
213+
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
207214
};
208215

209216
mockVerifyAccessToken.mockRejectedValue(new InvalidTokenError("Token expired"));
210217

211218
const middleware = requireBearerAuth({ verifier: mockVerifier });
212219
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
213220

214-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("invalid-token");
221+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("invalid-token", LATEST_PROTOCOL_VERSION);
215222
expect(mockResponse.status).toHaveBeenCalledWith(401);
216223
expect(mockResponse.set).toHaveBeenCalledWith(
217224
"WWW-Authenticate",
@@ -226,14 +233,15 @@ describe("requireBearerAuth middleware", () => {
226233
it("should return 403 when access token has insufficient scopes", async () => {
227234
mockRequest.headers = {
228235
authorization: "Bearer valid-token",
236+
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
229237
};
230238

231239
mockVerifyAccessToken.mockRejectedValue(new InsufficientScopeError("Required scopes: read, write"));
232240

233241
const middleware = requireBearerAuth({ verifier: mockVerifier });
234242
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
235243

236-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
244+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
237245
expect(mockResponse.status).toHaveBeenCalledWith(403);
238246
expect(mockResponse.set).toHaveBeenCalledWith(
239247
"WWW-Authenticate",
@@ -248,14 +256,15 @@ describe("requireBearerAuth middleware", () => {
248256
it("should return 500 when a ServerError occurs", async () => {
249257
mockRequest.headers = {
250258
authorization: "Bearer valid-token",
259+
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
251260
};
252261

253262
mockVerifyAccessToken.mockRejectedValue(new ServerError("Internal server issue"));
254263

255264
const middleware = requireBearerAuth({ verifier: mockVerifier });
256265
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
257266

258-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
267+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
259268
expect(mockResponse.status).toHaveBeenCalledWith(500);
260269
expect(mockResponse.json).toHaveBeenCalledWith(
261270
expect.objectContaining({ error: "server_error", error_description: "Internal server issue" })
@@ -266,14 +275,15 @@ describe("requireBearerAuth middleware", () => {
266275
it("should return 400 for generic OAuthError", async () => {
267276
mockRequest.headers = {
268277
authorization: "Bearer valid-token",
278+
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
269279
};
270280

271281
mockVerifyAccessToken.mockRejectedValue(new OAuthError("custom_error", "Some OAuth error"));
272282

273283
const middleware = requireBearerAuth({ verifier: mockVerifier });
274284
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
275285

276-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
286+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
277287
expect(mockResponse.status).toHaveBeenCalledWith(400);
278288
expect(mockResponse.json).toHaveBeenCalledWith(
279289
expect.objectContaining({ error: "custom_error", error_description: "Some OAuth error" })
@@ -284,14 +294,15 @@ describe("requireBearerAuth middleware", () => {
284294
it("should return 500 when unexpected error occurs", async () => {
285295
mockRequest.headers = {
286296
authorization: "Bearer valid-token",
297+
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
287298
};
288299

289300
mockVerifyAccessToken.mockRejectedValue(new Error("Unexpected error"));
290301

291302
const middleware = requireBearerAuth({ verifier: mockVerifier });
292303
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
293304

294-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
305+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
295306
expect(mockResponse.status).toHaveBeenCalledWith(500);
296307
expect(mockResponse.json).toHaveBeenCalledWith(
297308
expect.objectContaining({ error: "server_error", error_description: "Internal Server Error" })

‎src/server/auth/middleware/bearerAuth.ts‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import { RequestHandler } from "express";
22
import { InsufficientScopeError, InvalidTokenError, OAuthError, ServerError } from "../errors.js";
33
import { OAuthTokenVerifier } from "../provider.js";
44
import { AuthInfo } from "../types.js";
5+
import { DEFAULT_NEGOTIATED_PROTOCOL_VERSION } from "../../../types.js";
56

67
export type BearerAuthMiddlewareOptions = {
78
/**
@@ -50,7 +51,12 @@ export function requireBearerAuth({ verifier, requiredScopes = [], resourceMetad
5051
throw new InvalidTokenError("Invalid Authorization header format, expected 'Bearer TOKEN'");
5152
}
5253

53-
const authInfo = await verifier.verifyAccessToken(token);
54+
let protocolVersion = req.headers["mcp-protocol-version"] ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
55+
if (Array.isArray(protocolVersion)) {
56+
protocolVersion = protocolVersion[protocolVersion.length - 1];
57+
}
58+
59+
const authInfo = await verifier.verifyAccessToken(token, protocolVersion);
5460

5561
// Check if token has the required scopes (if any)
5662
if (requiredScopes.length > 0) {

‎src/server/auth/provider.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,5 +80,5 @@ export interface OAuthTokenVerifier {
8080
/**
8181
* Verifies an access token and returns information about it.
8282
*/
83-
verifyAccessToken(token: string): Promise<AuthInfo>;
83+
verifyAccessToken(token: string, protocolVersion: string): Promise<AuthInfo>;
8484
}

0 commit comments

Comments
 (0)