Skip to content

fix: preserve transient OAuth discovery HTTP errors - #1071

Merged
DaleSeo merged 2 commits into
modelcontextprotocol:mainfrom
tsarlandie-oai:codex/oauth-discovery-transient-http-errors
Jul 28, 2026
Merged

fix: preserve transient OAuth discovery HTTP errors#1071
DaleSeo merged 2 commits into
modelcontextprotocol:mainfrom
tsarlandie-oai:codex/oauth-discovery-transient-http-errors

Conversation

@tsarlandie-oai

@tsarlandie-oai tsarlandie-oai commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Summary

Follow-up to #1069.

OAuth metadata discovery now preserves transport failures and HTTP 5xx responses, but HTTP 408 Request Timeout, 425 Too Early, and 429 Too Many Requests still fall through as though a metadata endpoint were absent. As a result, a temporary timeout, early-data rejection, or rate limit can cause discovery to continue to another endpoint or report a legacy fallback instead of surfacing the operational failure.

This change classifies HTTP 408, 425, and 429 alongside 5xx in the existing discovery_request helper. The resulting metadata error preserves both the actual response status and the failing discovery URL.

Compatibility

  • Preserve HTTP 401 challenge handling.
  • Preserve HTTP 404 and 405 discovery fallback, with separate regression cases for both.
  • Preserve the existing HTTP 5xx behavior.
  • Do not introduce automatic retries, new dependencies, or public API changes.

Regression coverage

Add nine parameterized cases covering HTTP 408, 425, and 429 at each of:

  1. The protected resource endpoint.
  2. The protected resource metadata endpoint.
  3. The authorization server metadata endpoint.

Each case verifies that discovery reports the correct failing URL and status and does not issue additional discovery requests. The regression was first reproduced against upstream main before applying the production fix.

Validation

  • cargo +1.96 test -p rmcp --lib --all-features (482 tests passing).
  • cargo +1.96 clippy --all-targets --all-features -- -D warnings.
  • cargo +nightly-2025-09-18 fmt --all -- --check.

@github-actions github-actions Bot added T-core Core library changes T-transport Transport layer changes labels Jul 28, 2026
@tsarlandie-oai
tsarlandie-oai marked this pull request as ready for review July 28, 2026 16:58
@tsarlandie-oai
tsarlandie-oai requested a review from a team as a code owner July 28, 2026 16:58
DaleSeo
DaleSeo previously approved these changes Jul 28, 2026

@DaleSeo DaleSeo left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for tightening the discovery error boundary!

Comment thread crates/rmcp/src/transport/auth.rs Outdated
if status.is_server_error()
|| matches!(
status,
StatusCode::REQUEST_TIMEOUT | StatusCode::TOO_MANY_REQUESTS

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would 425 would make the transient classification more complete?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added

@tsarlandie-oai
tsarlandie-oai force-pushed the codex/oauth-discovery-transient-http-errors branch from 7d80f6d to bf9e7c5 Compare July 28, 2026 18:53
@DaleSeo
DaleSeo merged commit 82a6c48 into modelcontextprotocol:main Jul 28, 2026
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

T-core Core library changes T-transport Transport layer changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants