-
Notifications
You must be signed in to change notification settings - Fork 65
Open
Description
When you run your MCP behind a proxy, the resource_metadata URL given by withMcpAuth an the resource URL given back by protectedResourceHandler is the local one and not the global one.
That means, even when my MCP handler is publicly available at https://example.org/api/mcp the resource_metadata given back by withMcpAuth is http://localhost:3000/.well-known/oauth-protected-resource and the resource field given back at https://example.org/.well-known/oauth-protected-resource is http://localhost:3000, which are the local URLs given by the proxy.
The current workaround is to feed withMcpAuth and protectedResourceHandler manipulated requests.
/app/api/mcp/[transport]/route.ts
const handler = (req: Request) => withMcpAuth(
...
)(new Request(
req.url.replace('http://localhost:3000', 'https://example.org'),
req
))/app/.well-known/oauth-protected-resource/route.ts
const handler = (req: Request) => protectedResourceHandler({
authServerUrls: "https://your-issuer-url.com"
})(new Request(
req.url.replace('http://localhost:3000', 'https://example.org'),
req
))Metadata
Metadata
Assignees
Labels
No labels