mirror of
https://github.com/open-webui/open-webui.git
synced 2025-12-12 04:15:25 +00:00
b766a23e36
When an MCP server's OAuth authorization server is on a different domain (e.g., Todoist MCP at ai.todoist.net with OAuth at todoist.com), the current implementation fails because it only looks for OAuth metadata at the MCP server's domain. This commit implements the full MCP Protected Resource discovery flow as specified in the MCP authorization spec: 1. Make an unauthenticated request to the MCP endpoint 2. Parse the WWW-Authenticate header to get the resource_metadata URL 3. Fetch the Protected Resource metadata 4. Extract the authorization_servers array 5. Use those servers for OAuth metadata discovery The fix is backwards-compatible - if Protected Resource discovery fails, it falls back to the existing behavior. Fixes #19794 |
||
|---|---|---|
| .. | ||
| images | ||
| mcp | ||
| telemetry | ||
| access_control.py | ||
| audit.py | ||
| auth.py | ||
| channels.py | ||
| chat.py | ||
| code_interpreter.py | ||
| embeddings.py | ||
| files.py | ||
| filter.py | ||
| groups.py | ||
| headers.py | ||
| logger.py | ||
| middleware.py | ||
| misc.py | ||
| models.py | ||
| oauth.py | ||
| payload.py | ||
| pdf_generator.py | ||
| plugin.py | ||
| rate_limit.py | ||
| redis.py | ||
| response.py | ||
| security_headers.py | ||
| task.py | ||
| tools.py | ||
| webhook.py | ||