Skip to content

Wrong host when behind proxy #110

@w41x

Description

@w41x

When you run your MCP behind a proxy, the resource_metadata URL given by withMcpAuth an the resource URL given back by protectedResourceHandler is the local one and not the global one.
That means, even when my MCP handler is publicly available at https://example.org/api/mcp the resource_metadata given back by withMcpAuth is http://localhost:3000/.well-known/oauth-protected-resource and the resource field given back at https://example.org/.well-known/oauth-protected-resource is http://localhost:3000, which are the local URLs given by the proxy.

The current workaround is to feed withMcpAuth and protectedResourceHandler manipulated requests.

/app/api/mcp/[transport]/route.ts

const handler = (req: Request) => withMcpAuth(
      ...
  )(new Request(
    req.url.replace('http://localhost:3000', 'https://example.org'),
    req
))

/app/.well-known/oauth-protected-resource/route.ts

const handler = (req: Request) => protectedResourceHandler({
      authServerUrls: "https://your-issuer-url.com"
  })(new Request(
    req.url.replace('http://localhost:3000', 'https://example.org'),
    req
))

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions