diff --git a/src/fastmcp/server/auth/oauth_proxy.py b/src/fastmcp/server/auth/oauth_proxy.py index 9bd5813ce..6b64bda49 100644 --- a/src/fastmcp/server/auth/oauth_proxy.py +++ b/src/fastmcp/server/auth/oauth_proxy.py @@ -240,7 +240,7 @@ class OAuthProxy(OAuthProvider): token_verifier: TokenVerifier, # FastMCP server configuration base_url: AnyHttpUrl | str, - redirect_path: str = "/auth/callback", + redirect_path: str | None = None, issuer_url: AnyHttpUrl | str | None = None, service_documentation_url: AnyHttpUrl | str | None = None, # Client redirect URI validation @@ -317,9 +317,12 @@ class OAuthProxy(OAuthProvider): self._default_scope_str = " ".join(self.required_scopes or []) # Store redirect configuration - self._redirect_path = ( - redirect_path if redirect_path.startswith("/") else f"/{redirect_path}" - ) + if not redirect_path: + self._redirect_path = "/auth/callback" + else: + self._redirect_path = ( + redirect_path if redirect_path.startswith("/") else f"/{redirect_path}" + ) self._allowed_client_redirect_uris = allowed_client_redirect_uris # PKCE configuration diff --git a/src/fastmcp/server/auth/providers/azure.py b/src/fastmcp/server/auth/providers/azure.py index 1ac5d975f..84a3d4791 100644 --- a/src/fastmcp/server/auth/providers/azure.py +++ b/src/fastmcp/server/auth/providers/azure.py @@ -211,7 +211,6 @@ class AzureProvider(OAuthProxy): # Apply defaults tenant_id_final = settings.tenant_id - redirect_path_final = settings.redirect_path or "/auth/callback" timeout_seconds_final = settings.timeout_seconds or 10 # Default scopes for Azure - User.Read gives us access to user info via Graph API scopes_final = settings.required_scopes or [ @@ -249,7 +248,7 @@ class AzureProvider(OAuthProxy): upstream_client_secret=client_secret_str, token_verifier=token_verifier, base_url=settings.base_url, - redirect_path=redirect_path_final, + redirect_path=settings.redirect_path, issuer_url=settings.base_url, allowed_client_redirect_uris=allowed_client_redirect_uris_final, ) diff --git a/src/fastmcp/server/auth/providers/github.py b/src/fastmcp/server/auth/providers/github.py index d4440e3f5..2a9490ff9 100644 --- a/src/fastmcp/server/auth/providers/github.py +++ b/src/fastmcp/server/auth/providers/github.py @@ -243,7 +243,6 @@ class GitHubProvider(OAuthProxy): # Apply defaults - redirect_path_final = settings.redirect_path or "/auth/callback" timeout_seconds_final = settings.timeout_seconds or 10 required_scopes_final = settings.required_scopes or ["user"] allowed_client_redirect_uris_final = settings.allowed_client_redirect_uris @@ -267,7 +266,7 @@ class GitHubProvider(OAuthProxy): upstream_client_secret=client_secret_str, token_verifier=token_verifier, base_url=settings.base_url, - redirect_path=redirect_path_final, + redirect_path=settings.redirect_path, issuer_url=settings.base_url, # We act as the issuer for client registration allowed_client_redirect_uris=allowed_client_redirect_uris_final, ) diff --git a/src/fastmcp/server/auth/providers/google.py b/src/fastmcp/server/auth/providers/google.py index 7f6dd1932..a8b0312c3 100644 --- a/src/fastmcp/server/auth/providers/google.py +++ b/src/fastmcp/server/auth/providers/google.py @@ -261,7 +261,6 @@ class GoogleProvider(OAuthProxy): ) # Apply defaults - redirect_path_final = settings.redirect_path or "/auth/callback" timeout_seconds_final = settings.timeout_seconds or 10 # Google requires at least one scope - openid is the minimal OIDC scope required_scopes_final = settings.required_scopes or ["openid"] @@ -286,7 +285,7 @@ class GoogleProvider(OAuthProxy): upstream_client_secret=client_secret_str, token_verifier=token_verifier, base_url=settings.base_url, - redirect_path=redirect_path_final, + redirect_path=settings.redirect_path, issuer_url=settings.base_url, # We act as the issuer for client registration allowed_client_redirect_uris=allowed_client_redirect_uris_final, ) diff --git a/src/fastmcp/server/auth/providers/workos.py b/src/fastmcp/server/auth/providers/workos.py index c6ff2714b..363f96f7d 100644 --- a/src/fastmcp/server/auth/providers/workos.py +++ b/src/fastmcp/server/auth/providers/workos.py @@ -220,7 +220,6 @@ class WorkOSProvider(OAuthProxy): if not authkit_domain_str.startswith(("http://", "https://")): authkit_domain_str = f"https://{authkit_domain_str}" authkit_domain_final = authkit_domain_str.rstrip("/") - redirect_path_final = settings.redirect_path or "/auth/callback" timeout_seconds_final = settings.timeout_seconds or 10 scopes_final = settings.required_scopes or [] allowed_client_redirect_uris_final = settings.allowed_client_redirect_uris @@ -245,7 +244,7 @@ class WorkOSProvider(OAuthProxy): upstream_client_secret=client_secret_str, token_verifier=token_verifier, base_url=settings.base_url, - redirect_path=redirect_path_final, + redirect_path=settings.redirect_path, issuer_url=settings.base_url, allowed_client_redirect_uris=allowed_client_redirect_uris_final, ) diff --git a/tests/server/auth/providers/test_auth0.py b/tests/server/auth/providers/test_auth0.py index a67643ca0..01f60e54b 100644 --- a/tests/server/auth/providers/test_auth0.py +++ b/tests/server/auth/providers/test_auth0.py @@ -272,4 +272,6 @@ class TestAuth0Provider: ) # Check defaults + assert str(provider.base_url) == TEST_BASE_URL + assert provider._redirect_path == "/auth/callback" assert provider._token_validator.required_scopes == ["openid"]