Allow http_client with static public_key in JWTVerifier

🤖 Generated with Claude Code

https://claude.ai/code/session_012QKWmKd21vypDmxWbwuE4e

src/fastmcp/server/auth/providers/jwt.py

@@ -201,7 +201,8 @@ class JWTVerifier(TokenVerifier):
         if public_key and jwks_uri:
             raise ValueError("Provide either public_key or jwks_uri, not both")
 
-        if ssrf_safe and http_client is not None:
+        # Only enforce ssrf_safe/http_client exclusivity when JWKS fetching is used
+        if jwks_uri and ssrf_safe and http_client is not None:
             raise ValueError(
                 "http_client cannot be used with ssrf_safe=True; "
                 "SSRF-safe mode requires its own hardened transport"

tests/server/auth/providers/test_http_client.py

@@ -180,11 +180,11 @@ class TestJWTVerifierHttpClient:
         assert result is not None
         assert not shared_client.is_closed
 
-    def test_ssrf_safe_rejects_http_client(
+    def test_ssrf_safe_rejects_http_client_with_jwks(
         self,
         shared_client: httpx.AsyncClient,
     ):
-        """ssrf_safe=True and http_client cannot be used together."""
+        """ssrf_safe=True and http_client cannot be used together with JWKS."""
         with pytest.raises(ValueError, match="cannot be used with ssrf_safe=True"):
             JWTVerifier(
                 jwks_uri="https://auth.example.com/.well-known/jwks.json",
@@ -192,6 +192,21 @@ class TestJWTVerifierHttpClient:
                 http_client=shared_client,
             )
 
+    def test_ssrf_safe_allows_http_client_with_static_key(
+        self,
+        rsa_key_pair: RSAKeyPair,
+        shared_client: httpx.AsyncClient,
+    ):
+        """ssrf_safe with http_client is allowed when using static public_key (no HTTP)."""
+        # This should NOT raise — static key means no JWKS fetching
+        verifier = JWTVerifier(
+            public_key=rsa_key_pair.public_key,
+            ssrf_safe=True,
+            http_client=shared_client,
+        )
+        assert verifier._http_client is shared_client
+        assert verifier.ssrf_safe is True
+
 
 class TestGitHubHttpClient:
     """Test http_client parameter on GitHubTokenVerifier."""