Apply the request body limit to the OAuth authorization server endpoints

create_auth_routes now wraps its endpoints in RequestBodyLimitMiddleware,
so /token, /revoke, /register and POST /authorize answer 413 to bodies
over the 4 MiB default before any form or JSON parsing. The limit sits
inside the CORS wrapper so browser clients still get CORS headers on the
413; GET and OPTIONS requests pass through untouched.

Author: maxisbey

docs/migration.md

@@ -863,7 +863,8 @@ single-exchange requests. Keep the smallest value your application actually need
 The SSE transport's message endpoint applies the same limit, configured the same way
 (`run(transport="sse", max_request_body_size=...)`, `sse_app(...)`, or
 `SseServerTransport(..., max_request_body_size=...)` when you mount the transport yourself), and
-answers HTTP 405 to anything other than POST.
+answers HTTP 405 to anything other than POST. The OAuth endpoints built by `create_auth_routes`
+(`/token`, `/register`, `/revoke`, and POST `/authorize`) are limited to the 4 MiB default.
 
 ### Streamable HTTP: lifespan now entered once at manager startup
 

src/mcp/server/auth/routes.py

@@ -17,6 +17,7 @@
 from mcp.server.auth.middleware.client_auth import ClientAuthenticator
 from mcp.server.auth.provider import OAuthAuthorizationServerProvider
 from mcp.server.auth.settings import ClientRegistrationOptions, RevocationOptions
+from mcp.server.streamable_http_manager import DEFAULT_MAX_REQUEST_BODY_SIZE, RequestBodyLimitMiddleware
 from mcp.shared.auth import JWT_BEARER_GRANT_TYPE, OAuthMetadata, ProtectedResourceMetadata
 from mcp.shared.inbound import MCP_PROTOCOL_VERSION_HEADER
 
@@ -51,12 +52,17 @@ def validate_issuer_url(url: AnyHttpUrl):
 ID_JAG_GRANT_PROFILE = "urn:ietf:params:oauth:grant-profile:id-jag"
 
 
+def _body_limited(handler: Callable[[Request], Response | Awaitable[Response]]) -> ASGIApp:
+    """Wrap an endpoint so POST bodies over the default limit are answered with 413 before it runs."""
+    return RequestBodyLimitMiddleware(request_response(handler), DEFAULT_MAX_REQUEST_BODY_SIZE)
+
+
 def cors_middleware(
     handler: Callable[[Request], Response | Awaitable[Response]],
     allow_methods: list[str],
 ) -> ASGIApp:
     cors_app = CORSMiddleware(
-        app=request_response(handler),
+        app=_body_limited(handler),
         allow_origins="*",
         allow_methods=allow_methods,
         allow_headers=[MCP_PROTOCOL_VERSION_HEADER],
@@ -102,7 +108,7 @@ def create_auth_routes(
             AUTHORIZATION_PATH,
             # do not allow CORS for authorization endpoint;
             # clients should just redirect to this
-            endpoint=AuthorizationHandler(provider).handle,
+            endpoint=_body_limited(AuthorizationHandler(provider).handle),
             methods=["GET", "POST"],
         ),
         Route(

tests/server/auth/test_error_handling.py

@@ -16,6 +16,7 @@
 from mcp.server.auth.provider import AuthorizeError, RegistrationError, TokenError
 from mcp.server.auth.routes import create_auth_routes
 from mcp.server.auth.settings import ClientRegistrationOptions, RevocationOptions
+from mcp.server.streamable_http_manager import DEFAULT_MAX_REQUEST_BODY_SIZE
 from tests.server.mcpserver.auth.test_auth_integration import MockOAuthProvider
 
 
@@ -288,3 +289,37 @@ async def test_token_error_handling_refresh_token(
         data = refresh_response.json()
         assert data["error"] == "invalid_scope"
         assert data["error_description"] == "The requested scope is invalid"
+
+
+_FORM = "application/x-www-form-urlencoded"
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize(
+    ("path", "content_type"),
+    [("/token", _FORM), ("/revoke", _FORM), ("/register", "application/json"), ("/authorize", _FORM)],
+)
+async def test_oversized_request_body_returns_413(client: httpx2.AsyncClient, path: str, content_type: str):
+    """Each endpoint that reads a request body rejects one over 4 MiB before parsing it."""
+    response = await client.post(
+        path, content=b"x" * (DEFAULT_MAX_REQUEST_BODY_SIZE + 1), headers={"Content-Type": content_type}
+    )
+    assert response.status_code == 413
+
+
+@pytest.mark.anyio
+async def test_request_body_within_the_limit_is_still_parsed(client: httpx2.AsyncClient):
+    """A small body is passed through to the handler intact: the form is parsed and its fields validated."""
+    response = await client.post("/token", data={"grant_type": "authorization_code"})
+    assert response.status_code == 401
+    assert response.json() == {"error": "invalid_client", "error_description": "Missing client_id"}
+
+
+@pytest.mark.anyio
+async def test_options_preflight_is_not_body_limited(client: httpx2.AsyncClient):
+    """CORS preflight requests still get their CORS answer; only POST bodies are limited."""
+    response = await client.options(
+        "/token", headers={"Origin": "https://client.example.com", "Access-Control-Request-Method": "POST"}
+    )
+    assert response.status_code == 200
+    assert response.headers["access-control-allow-origin"] == "*"