-
Notifications
You must be signed in to change notification settings - Fork 3.4k
URL Validation on Client Metadata is too strict #1665
Copy link
Copy link
Closed as not planned
Labels
P2Moderate issues affecting some users, edge cases, potentially valuable featureModerate issues affecting some users, edge cases, potentially valuable featureauthIssues and PRs related to Authentication / OAuthIssues and PRs related to Authentication / OAuthbugSomething isn't workingSomething isn't workingready for workEnough information for someone to start working onEnough information for someone to start working on
Metadata
Metadata
Assignees
Labels
P2Moderate issues affecting some users, edge cases, potentially valuable featureModerate issues affecting some users, edge cases, potentially valuable featureauthIssues and PRs related to Authentication / OAuthIssues and PRs related to Authentication / OAuthbugSomething isn't workingSomething isn't workingready for workEnough information for someone to start working onEnough information for someone to start working on
Initial Checks
Description
Pydantic AnyHttpUrl is too strict for client metadata validation. https://datatracker.ietf.org/doc/html/rfc7591#section-2 specifies that all fields are optional. Empty strings are commonly emitted when there's no value.
In addition fields like client_uri are informational and I'm not sure they should even be validated as http. Any URL should technically be supported including non-http URLs. In general, I think the SDK should only apply strict pydantic validation where it affects the security or functioning of the client.
1 validation error for OAuthClientInformationFull
client_uri
Input should be a valid URL, input is empty [type=url_parsing, input_value='', input_type=str]
For further information visit https://errors.pydantic.dev/2.11/v/url_parsing
Example Code
Python & MCP Python SDK