[v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource - #3451
Merged
Conversation
…en's resource v1.x backport. BearerAuthBackend takes an optional resource_server_url; when it is set, only a token the verifier reports as issued for that URL (AccessToken.resource, the RFC 8707 resource indicator, compared as a URL with a trailing slash tolerated) is accepted, and anything else is answered 401 like an unrecognized token. AuthSettings.validate_token_resource turns this on for FastMCP's SSE and Streamable HTTP apps; leaving it unset while resource_server_url is set emits a DeprecationWarning and behaves as False, and 3.0 makes True the default there. RefreshToken gains an optional resource so a provider can carry the binding through the refresh grant. TokenVerifier.verify_token's docstring and docs/authorization.md say where the token's audience goes and when to enable the option versus checking the audience in the verifier. The oauth_server snippet and the simple-auth example set it.
Contributor
📚 Documentation preview
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 10 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v1.x backport of #3447.
Adds
AuthSettings.validate_token_resource. When set, the bearer gate only accepts a token that theTokenVerifierreports as issued forresource_server_url(viaAccessToken.resource); a token reporting another resource, or none, gets the same 401 as an unrecognized token. Leaving it unset on a resource server emits aDeprecationWarningand behaves as off; 3.0 makes it the default there.RefreshTokengains an optionalresourceso providers can carry the binding through the refresh grant.Differences from #3447
FastMCP.sse_app()andFastMCP.streamable_http_app()insrc/mcp/server/fastmcp/server.py(main:Server.streamable_http_app()andMCPServer.sse_app()).DeprecationWarning, as v1.x has noMCPDeprecationWarning(same as [v1.x] Validate the authorization server metadata issuer on every discovery path #3431).BearerAuthBackendunit table and theAuthSettingswarning/validation tests, and the documentation lands indocs/authorization.md(theoauth_serversnippet it mirrors sets the option against its endpoint URL).How Has This Been Tested?
Unit tests as above; driven end to end under uvicorn on
FastMCPwith an introspection-backed verifier over Streamable HTTP (option on: a token for another resource gets 401 and one for this server 200; unset: behaviour unchanged apart from the warning); full suite with coverage, ruff, pyright.Breaking Changes
None. Unset behaves as off (with the deprecation warning);
BearerAuthBackend(verifier)and existing verifiers behave as before. Setting it toTruewithout aresource_server_urlraises at construction.Types of changes
Checklist
help wanted, or I'm a maintainer)AI Disclaimer