ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-28 02:10:38 +02:00
Code Issues Projects Releases Packages Wiki Activity

fix(google): use sub (user ID) for client_id instead of aud (app ID) (#3722)

Browse source
This commit is contained in:
AIKAWA Shigechika 2026-03-31 23:33:58 +09:00 • committed by GitHub
commit 5be249ada3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/fastmcp/server/auth/providers/google.py
View file

@ -173,7 +173,7 @@ class GoogleTokenVerifier(TokenVerifier):
access_token = AccessToken(
token=token,
client_id=aud,
client_id=sub,
scopes=token_scopes,
expires_at=expires_at,
claims={

6
tests/server/auth/providers/test_google.py
View file

@ -249,7 +249,7 @@ class TestGoogleTokenVerifier:
USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo"
async def test_valid_token_openid_only(self, httpx_mock: HTTPXMock):
"""A token with only openid scope is accepted; client_id comes from 'aud'."""
"""A token with only openid scope is accepted; client_id comes from 'sub'."""
httpx_mock.add_response(
url=_TOKENINFO_RE,
json={
@ -268,7 +268,7 @@ class TestGoogleTokenVerifier:
result = await verifier.verify_token("valid-token")
assert result is not None
assert result.client_id == "123.apps.googleusercontent.com"
assert result.client_id == "12345"
assert result.scopes == ["openid"]
assert result.expires_at is not None
assert result.claims["sub"] == "12345"
@ -305,7 +305,7 @@ class TestGoogleTokenVerifier:
result = await verifier.verify_token("valid-token")
assert result is not None
assert result.client_id == "123.apps.googleusercontent.com"
assert result.client_id == "12345"
assert "openid" in result.scopes
assert "https://www.googleapis.com/auth/userinfo.email" in result.scopes
assert "https://www.googleapis.com/auth/userinfo.profile" in result.scopes