Repository navigation
Trailing slash in .well-known/oauth-protected-resource response may violate “Canonical Server URI” requirement #1265
Description
Activity
- added a commit that references this issue
on Jan 23, 2026 I reproduced this on : the protected resource metadata endpoint serializes host-only and values with an implicit trailing (for example ). I have a focused fix and regression test prepared against that keeps route registration unchanged and only canonicalizes those root server URIs in the JSON response.
I reproduced this on
v1.x: the protected resource metadata endpoint serializes host-onlyresourceandauthorization_serversvalues with an implicit trailing/(for examplehttps://example.com/).I have a focused fix and regression test prepared against
v1.xthat keeps route registration unchanged and only canonicalizes those root server URIs in the JSON response.- added 2 commits that reference this issue
on Jul 11, 2026
Question
As I understand it,
https://your-mcp.com/.well-known/oauth-protected-resourceshould return:{ "resource": "https://your-mcp.com", "authorization_servers": [ "https://your-auth.com" ], "scopes_supported": [], "bearer_methods_supported": [ "header" ] }However, it actually returns:
{ "resource": "https://your-mcp.com/", "authorization_servers": [ "https://your-auth.com/" ], "scopes_supported": [], "bearer_methods_supported": [ "header" ] }Note the trailing
/in both theresourceandauthorization_serversvalues.According to the MCP spec’s “resource-parameter-implementation” section, I believe this violates the requirement for canonicalization:
https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#resource-parameter-implementation
Is this a bug, or am I misunderstanding the requirement?