ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-24 14:34:17 +02:00
Code Issues Projects Releases Packages Wiki Activity

Remove warning message in common scenario of all client redirect uri's permitted (#2156)

Browse source
This commit is contained in:
Jeremiah Lowin 2025-10-20 19:17:26 -04:00 • committed by GitHub
commit 7cecac5db0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 5 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

19
src/fastmcp/server/auth/oauth_proxy.py
View file

@ -605,15 +605,8 @@ class OAuthProxy(OAuthProvider):
self._redirect_path = (
redirect_path if redirect_path.startswith("/") else f"/{redirect_path}"
)
# Redirect URI validation (consent flow provides primary protection)
if allowed_client_redirect_uris is None:
logger.info(
"allowed_client_redirect_uris not specified; accepting all redirect URIs. "
"Consent flow provides protection against confused deputy attacks. "
"Configure allowed patterns for defense-in-depth."
)
self._allowed_client_redirect_uris = None
elif (
if (
isinstance(allowed_client_redirect_uris, list)
and not allowed_client_redirect_uris
):
@ -621,9 +614,7 @@ class OAuthProxy(OAuthProvider):
"allowed_client_redirect_uris is empty list; no redirect URIs will be accepted. "
"This will block all OAuth clients."
)
self._allowed_client_redirect_uris = []
else:
self._allowed_client_redirect_uris = allowed_client_redirect_uris
self._allowed_client_redirect_uris = allowed_client_redirect_uris
# PKCE configuration
self._forward_pkce = forward_pkce
@ -776,7 +767,7 @@ class OAuthProxy(OAuthProvider):
)
logger.info(
"Using ephemeral JWT signing key - tokens will NOT survive server restart. "
"For production, provide explicit jwt_signing_key parameter."
"For production, provide explicit jwt_signing_key parameter and use persistent storage."
)
# Initialize JWT issuer
@ -809,7 +800,7 @@ class OAuthProxy(OAuthProvider):
encryption_key = base64.urlsafe_b64encode(key_material)
logger.info(
"Using ephemeral token encryption key - encrypted tokens will NOT survive server restart. "
"For production, provide explicit token_encryption_key parameter."
"For production, provide explicit token_encryption_key parameter and use persistent storage."
)
self._token_encryption = TokenEncryption(encryption_key)