fix: Port A2A agent card RPC target origin validation to v1 - #6800
Merged
Conversation
Before this change, `RemoteA2aAgent` accepted whatever RPC URL an agent card advertised. Validation only checked that the card's `url` was non-empty and parsed into a scheme and a netloc, so a card fetched over the network could point the conversation, and any auth the client attaches to it, at any host, over cleartext if it liked. Endpoints beyond the top-level `url` were not looked at at all, even though the client factory negotiates its transport across the card's whole interface list and can pick one of them. Now, when the card was fetched over http or https, every URL it advertises must use https and match the origin the card came from, comparing scheme, host and port. Plain http stays allowed on a loopback host, which is the shape the A2A local-development helpers emit. A card supplied as an `AgentCard` object or read from a local file is left alone, since it did not come off the network. Behaviour change: a deployment that serves its agent card from one host and its RPC endpoint from another now raises `AgentCardResolutionError` instead of connecting, and so does one that advertises a cleartext endpoint off loopback. A differing port counts as a differing origin. Because the origin is compared against the URL that was configured rather than the one that finally answered, a card reached through a redirect to another origin is rejected as well. Passing the `AgentCard` object directly or pointing `agent_card` at a local file remains available for those cases. The upstream change routes endpoint enumeration through a compatibility module that straddles `a2a-sdk` 0.3.x and 1.x. This branch pins `a2a-sdk>=0.3.4,<0.4`, so the 0.3.x behaviour is implemented directly as a private helper in `remote_a2a_agent.py` instead.
GWeale
changed the title
DeanChensj
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports
fix: constrain the RPC targets of a network-fetched A2A agent card(upstream16cbb7d1) to thev1branch.agent_cardis anhttp://orhttps://URL, every endpoint the card advertises (top-levelurland eachadditional_interfaces[i].url) must match the source URL's origin — scheme, host and port — orRemoteA2aAgentraisesAgentCardResolutionError.http://is accepted only on a loopback host:localhost, a*.localhostname, or a loopback literal.A deployment whose card host differs from its RPC host passes an
AgentCardobject to the constructor, or pointsagent_cardat a local file path; both skip the check. No new public symbol, no opt-out flag.Endpoint enumeration is re-implemented as a private
_agent_card_rpc_urlsinremote_a2a_agent.pyrather than ported from upstream'sa2a/_compat.py.