From 7cecac5db0e471cb88b5212fc1bbd98d3379b131 Mon Sep 17 00:00:00 2001 From: Jeremiah Lowin <153965+jlowin@users.noreply.github.com> Date: Mon, 20 Oct 2025 19:17:26 -0400 Subject: [PATCH] Remove warning message in common scenario of all client redirect uri's permitted (#2156) --- src/fastmcp/server/auth/oauth_proxy.py | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) diff --git a/src/fastmcp/server/auth/oauth_proxy.py b/src/fastmcp/server/auth/oauth_proxy.py index 9729bcea2..717b6aa01 100644 --- a/src/fastmcp/server/auth/oauth_proxy.py +++ b/src/fastmcp/server/auth/oauth_proxy.py @@ -605,15 +605,8 @@ class OAuthProxy(OAuthProvider): self._redirect_path = ( redirect_path if redirect_path.startswith("/") else f"/{redirect_path}" ) - # Redirect URI validation (consent flow provides primary protection) - if allowed_client_redirect_uris is None: - logger.info( - "allowed_client_redirect_uris not specified; accepting all redirect URIs. " - "Consent flow provides protection against confused deputy attacks. " - "Configure allowed patterns for defense-in-depth." - ) - self._allowed_client_redirect_uris = None - elif ( + + if ( isinstance(allowed_client_redirect_uris, list) and not allowed_client_redirect_uris ): @@ -621,9 +614,7 @@ class OAuthProxy(OAuthProvider): "allowed_client_redirect_uris is empty list; no redirect URIs will be accepted. " "This will block all OAuth clients." ) - self._allowed_client_redirect_uris = [] - else: - self._allowed_client_redirect_uris = allowed_client_redirect_uris + self._allowed_client_redirect_uris = allowed_client_redirect_uris # PKCE configuration self._forward_pkce = forward_pkce @@ -776,7 +767,7 @@ class OAuthProxy(OAuthProvider): ) logger.info( "Using ephemeral JWT signing key - tokens will NOT survive server restart. " - "For production, provide explicit jwt_signing_key parameter." + "For production, provide explicit jwt_signing_key parameter and use persistent storage." ) # Initialize JWT issuer @@ -809,7 +800,7 @@ class OAuthProxy(OAuthProvider): encryption_key = base64.urlsafe_b64encode(key_material) logger.info( "Using ephemeral token encryption key - encrypted tokens will NOT survive server restart. " - "For production, provide explicit token_encryption_key parameter." + "For production, provide explicit token_encryption_key parameter and use persistent storage." ) self._token_encryption = TokenEncryption(encryption_key)