-
Notifications
You must be signed in to change notification settings - Fork 437
oauthex: add MatchesResource helper (RFC 9728/8707 audience comparison) #970
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
BorisTyshkevich
wants to merge
2
commits into
modelcontextprotocol:main
Choose a base branch
from
Altinity:oauthex-matches-resource
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+145
−0
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| // Copyright 2026 The Go MCP SDK Authors. All rights reserved. | ||
| // Use of this source code is governed by an MIT-style | ||
| // license that can be found in the LICENSE file. | ||
|
|
||
| package oauthex | ||
|
|
||
| import "strings" | ||
|
|
||
| // MatchesResource reports whether any of claims matches resource under | ||
| // RFC 3986 §6.2.3 scheme-based normalization, narrowed to the empty-path | ||
| // case: a URI with an empty path is treated as equivalent to one with a | ||
| // path of "/". All other URI components (scheme, host case, port, query, | ||
| // fragment) must match exactly — this is intentionally narrower than the | ||
| // full §6.2.3 rung, which would also fold scheme/host case and default | ||
| // ports. | ||
| // | ||
| // RFC 9728 §3.3 normatively requires "simple string comparison" per | ||
| // RFC 3986 §6.2.1 (byte-equal). Callers that need strict byte-equal | ||
| // semantics should compare claims to resource directly: | ||
| // | ||
| // for _, c := range claims { if c == resource { return true } } | ||
| // | ||
| // Background: RFC 9728 §3.3 canonicalises the protected-resource | ||
| // identifier with a trailing slash, but RFC 8707 resource indicators | ||
| // sometimes omit it, and upstream IdPs vary in which form they emit in | ||
| // `aud` claims (Google trims, Auth0 retains, claude.ai round-trips | ||
| // whichever it received). Strict byte equality therefore fails routinely | ||
| // on legitimate setups; this helper is the most common pragmatic relaxation | ||
| // while keeping path/scheme/host strict so token confusion across distinct | ||
| // resources still fails closed. | ||
| // | ||
| // Returns false when claims is empty. | ||
| func MatchesResource(claims []string, resource string) bool { | ||
| expected := strings.TrimRight(resource, "/") | ||
| for _, c := range claims { | ||
| if c == resource { | ||
| return true | ||
| } | ||
| if strings.TrimRight(c, "/") == expected { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| // Copyright 2026 The Go MCP SDK Authors. All rights reserved. | ||
| // Use of this source code is governed by an MIT-style | ||
| // license that can be found in the LICENSE file. | ||
|
|
||
| package oauthex | ||
|
|
||
| import "testing" | ||
|
|
||
| func TestMatchesResource(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| claims []string | ||
| resource string | ||
| want bool | ||
| }{ | ||
| { | ||
| name: "exact match", | ||
| claims: []string{"https://mcp.example.com/"}, | ||
| resource: "https://mcp.example.com/", | ||
| want: true, | ||
| }, | ||
| { | ||
| name: "claim has trailing slash, resource does not", | ||
| claims: []string{"https://mcp.example.com/"}, | ||
| resource: "https://mcp.example.com", | ||
| want: true, | ||
| }, | ||
| { | ||
| name: "claim missing trailing slash, resource has one", | ||
| claims: []string{"https://mcp.example.com"}, | ||
| resource: "https://mcp.example.com/", | ||
| want: true, | ||
| }, | ||
| { | ||
| name: "multiple claims, one matches", | ||
| claims: []string{"https://other.example.com/", "https://mcp.example.com"}, | ||
| resource: "https://mcp.example.com/", | ||
| want: true, | ||
| }, | ||
| { | ||
| name: "no claims", | ||
| claims: nil, | ||
| resource: "https://mcp.example.com/", | ||
| want: false, | ||
| }, | ||
| { | ||
| name: "claim does not match resource", | ||
| claims: []string{"https://attacker.example.com/"}, | ||
| resource: "https://mcp.example.com/", | ||
| want: false, | ||
| }, | ||
| { | ||
| name: "path mismatch is not tolerated", | ||
| claims: []string{"https://mcp.example.com/v2"}, | ||
| resource: "https://mcp.example.com", | ||
| want: false, | ||
| }, | ||
| { | ||
| name: "scheme mismatch is not tolerated", | ||
| claims: []string{"http://mcp.example.com/"}, | ||
| resource: "https://mcp.example.com/", | ||
| want: false, | ||
| }, | ||
| // The following document the intentional boundaries: §6.2.3 also | ||
| // permits scheme/host case folding and default-port elision, but | ||
| // MatchesResource deliberately does NOT, so two distinct | ||
| // registered resources cannot collide via these normalizations. | ||
| { | ||
| name: "host case difference is not tolerated", | ||
| claims: []string{"https://MCP.example.com/"}, | ||
| resource: "https://mcp.example.com/", | ||
| want: false, | ||
| }, | ||
| { | ||
| name: "default-port elision is not tolerated", | ||
| claims: []string{"https://mcp.example.com:443/"}, | ||
| resource: "https://mcp.example.com/", | ||
| want: false, | ||
| }, | ||
| { | ||
| name: "query string difference is not tolerated", | ||
| claims: []string{"https://mcp.example.com/?x=y"}, | ||
| resource: "https://mcp.example.com/", | ||
| want: false, | ||
| }, | ||
| { | ||
| name: "surrounding whitespace is not tolerated (malformed claim)", | ||
| claims: []string{" https://mcp.example.com/ "}, | ||
| resource: "https://mcp.example.com/", | ||
| want: false, | ||
| }, | ||
| } | ||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| got := MatchesResource(tt.claims, tt.resource) | ||
| if got != tt.want { | ||
| t.Errorf("MatchesResource(%v, %q) = %v, want %v", tt.claims, tt.resource, got, tt.want) | ||
| } | ||
| }) | ||
| } | ||
| } |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
TrimRightwill trim all the slashes from the right, let's change toTrimSuffix