fix(auth): strip trailing slashes from OAuth metadata URLs

[piyushbag]

Summary

• strip trailing slashes from issuer in build_metadata() before constructing OAuthMetadata
• strip trailing slashes from resource and each authorization_servers entry in create_protected_resource_routes()
• pass canonical URL strings so metadata models with url_preserve_empty_path serialize without a synthetic root slash
• add regression tests for AnyHttpUrl issuer inputs and root-level protected-resource metadata responses

Fixes #1919. Also fixes #1265.

Test plan

• uv run pytest tests/server/auth/test_routes.py -q
• uv run pytest tests/server/auth/test_protected_resource.py -q
• uv run pytest tests/server/auth/ -q
• uv run ruff check src/mcp/server/auth/routes.py tests/server/auth/test_routes.py tests/server/auth/test_protected_resource.py
• uv run pyright src/mcp/server/auth/routes.py

[cubic-dev-ai]

2 issues found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/mcp/server/auth/routes.py">

<violation number="1" location="src/mcp/server/auth/routes.py:172">
P2: Issuer canonicalization is over-broad: `rstrip('/')` also rewrites non-root path issuers (e.g. `/tenant/` -> `/tenant`), which can break exact issuer identifier matching.</violation>

<violation number="2" location="src/mcp/server/auth/routes.py:243">
P2: Protected-resource metadata now removes trailing slashes from all configured URLs, which can silently change path-based resource or authorization-server identifiers.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Protected-resource metadata now removes trailing slashes from all configured URLs, which can silently change path-based resource or authorization-server identifiers.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/mcp/server/auth/routes.py, line 243:

<comment>Protected-resource metadata now removes trailing slashes from all configured URLs, which can silently change path-based resource or authorization-server identifiers.</comment>

<file context>
@@ -237,8 +237,11 @@ def create_protected_resource_routes(
+        resource=cast(AnyHttpUrl, str(resource_url).rstrip("/")),
+        authorization_servers=cast(
+            list[AnyHttpUrl],
+            [str(server).rstrip("/") for server in authorization_servers],
+        ),
         scopes_supported=scopes_supported,
</file context>

[cubic-dev-ai]

P2: Issuer canonicalization is over-broad: rstrip('/') also rewrites non-root path issuers (e.g. /tenant/ -> /tenant), which can break exact issuer identifier matching.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/mcp/server/auth/routes.py, line 172:

<comment>Issuer canonicalization is over-broad: `rstrip('/')` also rewrites non-root path issuers (e.g. `/tenant/` -> `/tenant`), which can break exact issuer identifier matching.</comment>

<file context>
@@ -169,7 +169,7 @@ def build_metadata(
     # Create metadata
     metadata = OAuthMetadata(
-        issuer=issuer_url,
+        issuer=cast(AnyHttpUrl, str(issuer_url).rstrip("/")),
         authorization_endpoint=authorization_url,
         token_endpoint=token_url,
</file context>