ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-21 21:14:17 +02:00
Code Issues Projects Releases Packages Wiki Activity

Apply PR #2156 logging changes to oauth_dcr_proxy.py

Browse source 
- Remove info/warning logs for allowed_client_redirect_uris
- Add 'and use persistent storage' to production guidance for JWT signing key and token encryption key
This commit is contained in:
Jeremiah Lowin 2025-10-20 19:25:07 -04:00
commit e55cc531ad
1 changed files with 2 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/fastmcp/server/auth/oauth_dcr_proxy.py
View file

@ -607,20 +607,11 @@ class OAuthDCRProxy(OAuthProvider):
)
# Redirect URI validation (consent flow provides primary protection)
if allowed_client_redirect_uris is None:
logger.info(
"allowed_client_redirect_uris not specified; accepting all redirect URIs. "
"Consent flow provides protection against confused deputy attacks. "
"Configure allowed patterns for defense-in-depth."
)
self._allowed_client_redirect_uris = None
elif (
isinstance(allowed_client_redirect_uris, list)
and not allowed_client_redirect_uris
):
logger.warning(
"allowed_client_redirect_uris is empty list; no redirect URIs will be accepted. "
"This will block all OAuth clients."
)
self._allowed_client_redirect_uris = []
else:
self._allowed_client_redirect_uris = allowed_client_redirect_uris
@ -776,7 +767,7 @@ class OAuthDCRProxy(OAuthProvider):
)
logger.info(
"Using ephemeral JWT signing key - tokens will NOT survive server restart. "
"For production, provide explicit jwt_signing_key parameter."
"For production, provide explicit jwt_signing_key parameter and use persistent storage."
)
# Initialize JWT issuer
@ -809,7 +800,7 @@ class OAuthDCRProxy(OAuthProvider):
encryption_key = base64.urlsafe_b64encode(key_material)
logger.info(
"Using ephemeral token encryption key - encrypted tokens will NOT survive server restart. "
"For production, provide explicit token_encryption_key parameter."
"For production, provide explicit token_encryption_key parameter and use persistent storage."
)
self._token_encryption = TokenEncryption(encryption_key)