Skip to content

AuthSettings.issuer_url is required in resource-server-only mode but never used #3702

Closed as not planned
Closed as not planned
AuthSettings.issuer_url is required in resource-server-only mode but never used#3702
Labels
enhancementRequest for a new feature that's not currently supported

Description

@AkshayShah03
AkshayShah03
opened on Oct 13, 2026

Release line: 2.x (main @ 754254c)

Following up on #3283, where it was noted that token_verifier= shouldn't make you invent an authorization server. I didn't find an issue tracking that, so here's one.

What happens

For a server that only verifies bearer tokens (token_verifier=, no auth_server_provider, resource_server_url=None):

  • AuthSettings(resource_server_url=None) fails validation: issuer_url field required.
  • MCPServer(token_verifier=...) without auth= raises "Cannot specify auth_server_provider or token_verifier without auth settings".
  • With a placeholder such as issuer_url="https://placeholder.invalid", everything works: only /mcp is mounted, a missing token gets 401 and a valid one gets 200. The value is never read. It's only used when auth_server_provider is set (server.py:1218) or when the PRM document is served (server.py:1277).

Minor related point: resource_server_url is typed AnyHttpUrl | None but declared with Field(...), so None has to be passed explicitly.

What I expected

To configure a resource-server-only setup without a made-up URL.

Possible shape

  • issuer_url: AnyHttpUrl | None = None and resource_server_url: AnyHttpUrl | None = None.
  • Validate that issuer_url is set when resource_server_url is set, since the PRM authorization_servers needs an entry, and when auth_server_provider is used.
  • Existing configs behave the same. The only change is that the placeholder is no longer needed.

The alternative would be to allow token_verifier= without auth= at all, but that's a bigger change. Does the first shape fit, or would you prefer something different? I'm happy to implement whichever you prefer.

Repro script: https://gist.github.com/AkshayShah03/92d4d4eb6dcbbfa15c7f374e30e506a5

Investigation and repro done with AI assistance; I ran it and checked the output.

Activity

  1. claude
    added
    enhancementRequest for a new feature that's not currently supported
    on Oct 13, 2026

  2. lzif commented on Oct 14, 2026

    @lzif
    lzif
    on Oct 14, 2026

    Verified on current main (754254c0, 2026-10-13):

    • AuthSettings(resource_server_url=None) raises ValidationError: 1 validation error for AuthSettings / issuer_url / Field required — reproduces exactly as described.
    • Audited all issuer_url read sites: src/mcp/server/lowlevel/server.py:803 (inside if auth_server_provider:), :839 (inside if auth and auth.resource_server_url:), src/mcp/server/mcpserver/server.py:1218 (inside if self._auth_server_provider:), :1277 (inside the resource_server_url branch). In resource-server-only mode (token_verifier set, no auth server provider, no resource_server_url) none of them execute — so the mandatory field is never read.

    The incremental fix shape from the issue (optional issuer_url/resource_server_url plus a validator requiring issuer_url only when resource_server_url is set or an auth server provider is used) matches this audit.

    Note: open PR #3292 takes the alternative, bigger approach (token verifier without AuthSettings at all) — flagging in case maintainers prefer it.

    Disclosure: this verification was AI-assisted (per this repo's CONTRIBUTING).

  3. sattyamjjain commented on Oct 15, 2026

    @sattyamjjain
    sattyamjjain
    on Oct 15, 2026

    Adding to what @lzif listed, two things to know about RS-only mode without resource_server_url (checked at 754254c):

    1. No protected resource metadata is served, and the 401 carries no resource_metadata in WWW-Authenticate. resource_metadata_url and the PRM routes are only set up when auth.resource_server_url is set (bearer_auth.py L139-140 adds the header only then). The MCP spec says servers "MUST implement one of the following discovery mechanisms to provide authorisation server location information to MCP clients", so in this mode discovery has to come from outside the SDK, for example, a gateway or a separately hosted PRM.

    2. validate_token_resource requires resource_server_url, so the audience check has to live in your TokenVerifier. The spec: "MCP servers MUST validate that access tokens were issued specifically for them as the intended audience".

    Also, the validator you proposed matches the MCP spec, which is stricter than RFC 9728. RFC 9728 marks authorization_servers as OPTIONAL, while the MCP spec says the PRM document "MUST include the authorization_servers field containing at least one authorisation server."
    https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization

  4. AkshayShah03 commented on Oct 15, 2026

    @AkshayShah03
    AkshayShah03
    on Oct 15, 2026
    Author

    Thanks @lzif, I missed that #3292 already covers this (and more). Closing as a duplicate; I'll follow up there instead.

  5. AkshayShah03
    closed this as not plannedon Oct 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementRequest for a new feature that's not currently supported

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions