Repository navigation
OAuth2 Discovery method fails because FastMCP with GoogleProvider (OAuth) returns issuerUrl with trailing slash #7265
Description
The OAuth2DiscoveryManager.discover_auth_server_metadata function retrieves a remote MCP Server's discovery document, to initialize the tool's AuthScheme object.
The function compares the returned issuer URL to the provided issuer URL to defend against MIX-UP attacks (as documented):
if metadata.issuer == issuer_url.rstrip("/"):
However, if the returned issuer has a trailing slash ('/'), as is the case when using FastMCP and the GoogleProvider, the function fails to compare the issuer values and no metadata is returned.
The correct code should be:
if metadata.issuer.rstrip("/") == issuer_url.rstrip("/"):
This is an example of what FastMCP is returning when using SSE transport with a GoogleProvider:
{
"issuer": "http://localhost:8080/",
"authorization_endpoint": "http://localhost:8080/authorize",
"token_endpoint": "http://localhost:8080/token",
"registration_endpoint": "http://localhost:8080/register",
"scopes_supported": [
"openid",
"https://www.googleapis.com/auth/userinfo.email"
],
"response_types_supported": [
"code"
],
"grant_types_supported": [
"authorization_code",
"refresh_token"
],
"token_endpoint_auth_methods_supported": [
"client_secret_post",
"client_secret_basic",
"private_key_jwt",
"none"
],
"code_challenge_methods_supported": [
"S256"
],
"client_id_metadata_document_supported": true
}
Activity
chelsealong commentedon Sep 24, 2026
Picking this one up now — opening a PR shortly. Flagging it here so nobody duplicates the work; if someone is already on it, say so and I will drop mine.
sanketpatil06 commentedon Sep 25, 2026
Hi @idofl, thanks for reporting this. A fix has been opened in PR #7268. Please feel free to test the PR branch and let us know if it resolves the issue on your end. The team will merge it once review is complete.
idofl commentedon Sep 27, 2026
I reviewed the change and it looks good to me. Thank you for the quick fix.
fix: tolerate trailing slash on discovered OAuth2 issuer