ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-18 03:29:11 +02:00
Code Issues Projects Releases Packages Wiki Activity
2,538 commits 156 branches 116 tags 100 MiB
Commit graph

47 commits

Author SHA1 Message Date
Jeremiah Lowin
9cade6c8c8
 		Fix RFC 8414 path-aware authorization server metadata discovery (#2533) 
* Fix RFC 8414 path-aware authorization server metadata discovery

Override get_well_known_routes() in OAuthProvider to rewrite the
authorization server metadata route to be path-aware based on issuer_url,
matching how protected resource metadata already works.

Closes #2527

* Update readme
 2025-12-03 19:16:59 -05:00
Jeremiah Lowin
ba69fba305
 		Add consent_csp_policy parameter for CSP customization (#2484) 
* Add consent_csp_policy parameter to OAuthProxy

Allows customization or disabling of CSP directives on the consent page.
Fixes #2476.

* Add consent_csp_policy to OIDCProxy and update docs

* Fix HTML injection vulnerability in CSP policy

HTML-escape the CSP policy value before inserting into meta tag to prevent HTML injection when CSP policies contain quotes.
 2025-11-26 16:53:40 -05:00
Jeremiah Lowin
0fa3097153
 		Add version badge for DebugTokenVerifier in documentation (#2390) 
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
 2025-11-06 18:25:26 -05:00
Jeremiah Lowin
de58bb0e6c
 		Add DebugTokenVerifier with custom sync/async validation (#2296) 
* Add DebugTokenVerifier with custom sync/async validation

* move import
 2025-10-31 10:38:01 -04:00
Jeremiah Lowin
15dbe7ecf0
 		Add custom token verifier support to OIDCProxy (#2279) 
* Add custom token verifier support to OIDCProxy

OIDCProxy now accepts an optional token_verifier parameter to support
non-JWT token formats like opaque tokens from providers such as Clerk.

When provided, the custom verifier is used instead of creating a default
JWTVerifier. Parameters that only apply to JWTVerifier creation (algorithm,
required_scopes) raise clear errors when specified alongside a custom
verifier. Parameters with other purposes (audience for OAuth flow,
timeout_seconds for config fetch) remain allowed.

The custom verifier's required_scopes are automatically loaded and
advertised through OAuth discovery endpoints.

* Document custom token verifier support in OIDC proxy
 2025-10-27 13:38:20 -04:00
William Easton
063ffe9f64
 		Derive jwt_signing_key from Client Secret, default to Encrypted Disk Store (#2223) 
* Checkpoint progress

* Checkpoint progress

* add derive b64 method

* PR clean-up

* refactor da proxy

* Updates to tests

* Make jwt_signing_key required for oauth proxy

* use typing_extensions and fix tests

* PR Cleanup

* also adjust integration tests

* Update docs, use client secret to derive jwt signing key

* You win some you lose some, gg claude

* check for both in derive

* update documentation / clean up

* Update http.mdx

---------

Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2025-10-24 19:08:58 -04:00
Jeremiah Lowin
686082a5b5
 		Add platform-aware OAuth token persistence (#2218) 
* Add comprehensive keyring integration tests

Prevents OS keyring pollution during testing by adding a global mock in
conftest.py. Tests verify keyring behavior across platforms and fallback
scenarios without writing to the actual system keyring.

- Add global mock_keyring fixture to tests/conftest.py
- Add TestOAuthProxyKeyring class with 6 keyring-specific tests
- Remove try/except ImportError for keyring (now required dependency)
- Add keyring extra to py-key-value-aio dependency
- Clean up extraneous implementation comments in oauth_proxy.py

* Update OAuth keyring documentation

Update all OAuth-related documentation to reflect keyring-based key management:
- Add version badges to jwt_signing_key, token_encryption_key, and client_storage parameters
- Standardize "Default behavior (`None`):" formatting with backticks
- Ensure consistent messaging about development-only defaults across all docs
- Update oauth-proxy.mdx, oidc-proxy.mdx, http.mdx, storage-backends.mdx, and upgrade-guide.mdx
 2025-10-22 20:42:24 -04:00
Jeremiah Lowin
9987a456a0
 		Allow authorization consent screen to be disabled (#2172) 
* Add optional authorization consent screen for OAuth providers

Adds `require_authorization_consent` parameter (default True) to OAuthProxy and all providers. When disabled, authorization skips the consent screen for local development/testing. Logs security warning when disabled.

* Update warning message to use 'authorization consent screen'
 2025-10-21 10:00:39 -04:00
Jeremiah Lowin
b362444ddf
 		Add storage backend documentation (#2137) 
* Add storage backend documentation

* Add storage patterns documentation for wrapper caching strategies

- Add PassthroughCacheWrapper section for multi-tier caching
- Document TTL clamping strategy for optimized memory usage
- Add example for wrapping custom storage implementations
- Explain how to combine fast in-memory caches with persistent remote stores

* Update docs
 2025-10-19 19:24:13 -04:00
Jeremiah Lowin
9e78d755c2
 		Support custom server name, icons, and link in OAuth Proxy consent page (#2135) 
* Implement icon support in fastmcp

* Fix icon feature tests

- Update snapshot for ResourceTemplate to include icons field
- Remove OAuth mounting tests (belong to PR #2119, not this feature)

* Update docs

* Customize consent screen

* Use server website link if available

* Anchor link shouldnt have trailing slash

* Remove 'a FastMCP server named' from consent page message

* Update docs
 2025-10-18 11:49:26 -04:00
Jeremiah Lowin
330eaed11f
 		OAuth proxy issues its own tokens (#2109) 
* OAuth proxy issues its own tokens

Implement token factory pattern where proxy issues FastMCP JWTs
instead of forwarding upstream tokens. Tokens are minimal references
(JTI) that map to encrypted upstream credentials stored server-side.

* Update run-tests.yml

* Update secret generation and docs

* Add upgrade guide
 2025-10-17 14:31:53 -04:00
Jeremiah Lowin
d472e30765
 		Support mounting OAuth-protected servers under path prefixes (#2119) 
* Add issuer_url parameter to OAuth providers for mounting scenarios

* Add get_well_known_routes

* Update docs

* Improve docs and tests

* Trigger CI

* Fix conditional test execution for Windows
 2025-10-17 11:44:49 -04:00
Jeremiah Lowin
52e9af1214
 		Add RFC 7662 token introspection provider (#2074) 2025-10-16 10:57:06 -04:00
Jeremiah Lowin
7b7e277d5d
 		Prevent confused deputy attacks in OAuth proxy (#2056) 2025-10-11 10:53:54 -04:00
Stephan Eberle
5486b5a3b9
 		Add AWS Cognito OAuth Provider for Enterprise Authentication (#1873) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2025-09-25 11:08:45 -04:00
Jeremiah Lowin
b3ea6ad384
 		docs: update OAuth and OIDC proxy documentation (#1880) 2025-09-21 11:02:36 -04:00
Jeremiah Lowin
7176d4f293
 		Add persistent storage for OAuth client registrations (#1879) 2025-09-21 10:56:08 -04:00
Anvi Banga
59e250a98e
 		feat: Add support for Descope Authentication (#1853) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2025-09-19 13:46:44 -04:00
Ruhul Alam
972521146f
 		feat: Add support for OIDC configuration (#1817) 2025-09-14 14:54:48 -04:00
Jeremiah Lowin
3dd7373680
 		feat: Add flexible parameter forwarding to OAuth proxy (#1771) 2025-09-06 15:50:29 -04:00
Jeremiah Lowin
46a5187398
 		Add token_endpoint_auth_method parameter to OAuthProxy (#1736) 2025-09-03 12:21:40 -04:00
Jeremiah Lowin
1045eb47c2
 		OAuth proxy PKCE forwarding (#1733) 2025-09-03 12:11:38 -04:00
Jeremiah Lowin
d36ea42b92
 		Fix OAuth resource URL handling and WWW-Authenticate header (#1706) 2025-09-02 15:14:05 -04:00
Jeremiah Lowin
deff09fe07
 		refactor: replace auth provider registry with ImportString (#1710) 2025-09-02 08:31:52 -04:00
Jeremiah Lowin
8c678b552b
 		Add resource_server_url parameter to OAuth proxy providers (#1682) 2025-08-30 08:33:13 -04:00
romanusyk
210e9cc5ca
 		Add default scope handling in OAuth proxy (#1667) 2025-08-29 09:58:45 -04:00
Jeremiah Lowin
6d9088704e
 		Fix OAuth redirect URI validation for DCR compatibility (#1661) 2025-08-28 15:19:56 -04:00
Jeremiah Lowin
c730aaa6b0
 		Document symmetric key JWT verification support (#1586) 2025-08-22 19:35:08 -04:00
Jeremiah Lowin
839a022b07
 		Add configurable redirect URI validation for OAuth providers (#1582) 2025-08-22 15:52:56 -04:00
Sebastian Kalisz
fe8056fe30
 		Added import of AuthProxy to auth __init__ (#1568) 2025-08-21 16:28:02 -04:00
Jeremiah Lowin
c3d1176a69
 		Add WorkOS and Azure OAuth providers (#1550) 2025-08-20 16:22:03 -04:00
Sebastian Kalisz
f7738c6f92
 		Fixed wrong import path in new docs page (#1538) 2025-08-19 10:26:48 -04:00
Jeremiah Lowin
ec015de3b0
 		Add OAuth proxy that allows authentication with social IDPs without DCR support (#1434) 2025-08-18 13:39:58 -04:00
Jeremiah Lowin
ec52e74b48
 		Introduce RemoteAuthProvider for cleaner external identity provider integration, update docs (#1346) 2025-08-02 20:36:38 -04:00
Jeremiah Lowin
a965d0d836
 		Docs updates (#1336) 2025-08-01 20:39:55 -04:00
Jeremiah Lowin
b46d4934a8
 		Add comprehensive OAuth 2.1 authentication system with WorkOS integration (#1327) 2025-08-01 17:06:55 -04:00
Jeremiah Lowin
60ca72bb0b
 		Add complete support for TokenVerifier protocol (#1297) 2025-07-29 20:01:40 -04:00
Shane Stene
4a5a2b6d17 config algorithm support 2025-06-30 16:33:25 -05:00
Jeremiah Lowin
44f14b1f7b Clean up parameter documentation 2025-06-22 20:59:53 -04:00
Jeremiah Lowin
ffe0c92d63 Alias streamable-http as http 2025-06-22 20:00:11 -04:00
Jeremiah Lowin
e245155bc5 Simplify docs nav 2025-06-20 20:48:42 -04:00
Jeremiah Lowin
5a0f57498f remove empty parens from tool 2025-06-05 14:55:32 -04:00
Jeremiah Lowin
a551b3468b Add tags 2025-06-04 18:36:10 -04:00
Jeremiah Lowin
b3f80c5374 Add empty parens to docs 2025-06-04 17:39:57 -04:00
Jeremiah Lowin
d1549c3d35 Remove empty parens 2025-06-04 15:37:55 -04:00
Jeremiah Lowin
93d84489fc Update auth docs 2025-06-03 09:11:50 -04:00
Jeremiah Lowin
132db32e51 Add auth docs 2025-06-01 21:33:33 -04:00