Skip to content

feat(auth): support custom scope in authorization requests #491

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

xiaoyijun
Copy link
Contributor

@xiaoyijun xiaoyijun commented May 14, 2025

Add support for specifying custom OAuth scopes during authorization requests, separating client registration metadata from authorization request parameters.

Motivation and Context

Previously, the authorization request was hardcoded to use the scope from client metadata (clientMetadata.scope)(in #464), which incorrectly mixed two different OAuth 2.0 concepts:

  1. Client Registration Metadata: defines the maximum scope capabilities a client is registered for
  2. Authorization Request Parameters: specific scope requested during an individual authorization flow

This change properly separates these concerns by:

  • Making the scope in authorization requests configurable
  • Allowing different scopes for different authorization flows
  • Maintaining the original client metadata scope for registration purposes

This better aligns with OAuth 2.0 specification where authorization request scopes and client registration metadata serve different purposes.

How Has This Been Tested?

Existing unit tests passed.

Breaking Changes

No. If the scope is not provided, it will fallback to clientMetadata.scope.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

This change focuses on architectural correctness in OAuth 2.0 implementation by properly separating client registration metadata from authorization request parameters. While this is a breaking change, it enforces better OAuth 2.0 practices by making scope requirements explicit in authorization requests.

Migration guide:

// Old code
await auth(provider, { serverUrl });

// New code
await auth(provider, { 
  serverUrl,
  scope: "your-required-scope" // Explicitly specify the scope
});

@xiaoyijun
Copy link
Contributor Author

Hi @pcarleton @ihrpr , I hope you don't mind me tagging you here. Would you mind taking a look at this PR? I've made some changes to properly separate the OAuth scopes between client registration metadata and authorization requests.

Would really appreciate your thoughts on this, especially if you see any potential issues or have suggestions for improvement.

Copy link
Contributor

@pcarleton pcarleton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, thanks for this.

I added one suggestion lmkwyt

Copy link
Contributor

@pcarleton pcarleton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks

@pcarleton pcarleton merged commit 66dec56 into modelcontextprotocol:main May 14, 2025
2 checks passed
@xiaoyijun xiaoyijun deleted the feat-support-custom-scope-in-auth-request branch May 15, 2025 02:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants