drop the PRM trailing-slash normalizer: superseded by #2925 (url_preserve_empty_path)

Author: fede-kamel

src/mcp/client/auth/oauth2.py

@@ -109,18 +109,6 @@ def check_registration_usable(client_info: OAuthClientInformationFull) -> None:
         )
 
 
-def _normalize_resource_url(resource: str) -> str:
-    """Undo the trailing slash URL parsers add to bare-domain URLs (e.g. pydantic's AnyHttpUrl).
-
-    RFC 9728 requires exact-string identity on the resource identifier, so only a root path
-    with no query or fragment is stripped; trailing slashes on deeper paths are preserved.
-    """
-    parsed = urlparse(resource)
-    if parsed.path == "/" and not parsed.params and not parsed.query and not parsed.fragment:
-        return f"{parsed.scheme}://{parsed.netloc}"
-    return resource
-
-
 class PKCEParameters(BaseModel):
     """PKCE (Proof Key for Code Exchange) parameters."""
 
@@ -218,7 +206,7 @@ def get_resource_url(self) -> str:
 
         # If PRM provides a resource that's a valid parent, use it
         if self.protected_resource_metadata and self.protected_resource_metadata.resource:
-            prm_resource = _normalize_resource_url(str(self.protected_resource_metadata.resource))
+            prm_resource = str(self.protected_resource_metadata.resource)
             if check_resource_allowed(requested_resource=resource, configured_resource=prm_resource):
                 resource = prm_resource
 

tests/client/test_auth.py

@@ -983,47 +983,6 @@ async def test_get_resource_url_uses_canonical_when_prm_mismatches(
     assert provider.context.get_resource_url() == snapshot("https://api.example.com/v1/mcp")
 
 
-@pytest.mark.anyio
-async def test_get_resource_url_removes_root_prm_trailing_slash(
-    client_metadata: OAuthClientMetadata, mock_storage: MockTokenStorage
-) -> None:
-    """Bare-domain PRM resources should not pick up the trailing slash AnyHttpUrl adds."""
-    provider = OAuthClientProvider(
-        server_url="https://api.example.com",
-        client_metadata=client_metadata,
-        storage=mock_storage,
-    )
-    provider._initialized = True
-
-    # AnyHttpUrl normalizes "https://api.example.com" to "https://api.example.com/"
-    provider.context.protected_resource_metadata = ProtectedResourceMetadata(
-        resource=AnyHttpUrl("https://api.example.com"),
-        authorization_servers=[AnyHttpUrl("https://auth.example.com")],
-    )
-
-    assert provider.context.get_resource_url() == snapshot("https://api.example.com")
-
-
-@pytest.mark.anyio
-async def test_get_resource_url_preserves_non_root_trailing_slash(
-    client_metadata: OAuthClientMetadata, mock_storage: MockTokenStorage
-) -> None:
-    """RFC 9728 requires exact-string identity, so intentional trailing slashes on deeper paths stay."""
-    provider = OAuthClientProvider(
-        server_url="https://api.example.com/v1/mcp/",
-        client_metadata=client_metadata,
-        storage=mock_storage,
-    )
-    provider._initialized = True
-
-    provider.context.protected_resource_metadata = ProtectedResourceMetadata(
-        resource=AnyHttpUrl("https://api.example.com/v1/mcp/"),
-        authorization_servers=[AnyHttpUrl("https://auth.example.com")],
-    )
-
-    assert provider.context.get_resource_url() == snapshot("https://api.example.com/v1/mcp/")
-
-
 class TestRegistrationResponse:
     """Test client registration response handling."""