o
ia- @ s d Z ddlmZ ddlZddlmZ ddlmZ ddl m
Z
ddl m Z ddl
mZ dd lmZ dd
lmZmZmZmZmZ erFdd lmZ eeZ ddddZG dd deZdS ) a Enhanced authorization handler with improved error responses.
This module provides an enhanced authorization handler that wraps the MCP SDK's
AuthorizationHandler to provide better error messages when clients attempt to
authorize with unregistered client IDs.
The enhancement adds:
- Content negotiation: HTML for browsers, JSON for API clients
- Enhanced JSON responses with registration endpoint hints
- Styled HTML error pages with registration links/forms
- Link headers pointing to registration endpoints
) annotationsN)
TYPE_CHECKING)AuthorizationHandler)
AnyHttpUrl)Request)Response)
get_logger)INFO_BOX_STYLESTOOLTIP_STYLES create_logo create_pagecreate_secure_html_response) OAuthAuthorizationServerProviderClient Not Registered client_idstrregistration_endpointdiscovery_endpoint server_name
str | Noneserver_icon_urltitlereturnc
C sp ddl }|| }d| d}d} d}
dt||pdd d
| d | d | d
|
d } tt d } t| || dS )a Create styled HTML error page for unregistered client attempts.
Args:
client_id: The unregistered client ID that was provided
registration_endpoint: URL of the registration endpoint
discovery_endpoint: URL of the OAuth metadata discovery endpoint
server_name: Optional server name for branding
server_icon_url: Optional server icon URL
title: Page title
Returns:
HTML string for the error page
r NzI
The client ID zN was not found in the server's client registry.
a
Your MCP client opened this page to complete OAuth authorization,
but the server did not recognize its client ID. To fix this:
- Close this browser window
- Clear authentication tokens in your MCP client (or restart it)
- Try connecting again - your client should automatically re-register
a
Why am I seeing this?
OAuth 2.0 requires clients to register before authorization.
This server returned a 400 error because the provided client
ID was not found.
In browser-delegated OAuth flows, your application cannot
detect this error automatically; it's waiting for a
callback that will never arrive. You must manually clear
auth tokens and reconnect.
z-
FastMCP)icon_urlalt_textz
z
z
z
z
aU
/* Error variant for info-box */
.info-box.error {
background: #fef2f2;
border-color: #f87171;
}
.info-box.error strong {
color: #991b1b;
}
/* Warning variant for info-box (yellow) */
.info-box.warning {
background: #fffbeb;
border-color: #fbbf24;
}
.info-box.warning strong {
color: #92400e;
}
.info-box code {
background: rgba(0, 0, 0, 0.05);
padding: 2px 6px;
border-radius: 3px;
font-family: 'SF Mono', Monaco, 'Cascadia Code', monospace;
font-size: 0.9em;
}
.info-box ul {
margin: 10px 0;
padding-left: 20px;
}
.info-box li {
margin: 6px 0;
}
)contentr additional_styles)htmlescaper r r
r )
r r r r r r html_moduleclient_id_escaped error_box warning_box help_linkr r r% l/var/www/html/karishye-ai-python/venv/lib/python3.10/site-packages/fastmcp/server/auth/handlers/authorize.py create_unregistered_client_html) s:
%r' c s@ e Zd ZdZ dd fd
d
Zd fdd ZdddZ ZS )r a; Authorization handler with enhanced error responses for unregistered clients.
This handler extends the MCP SDK's AuthorizationHandler to provide better UX
when clients attempt to authorize without being registered. It implements
content negotiation to return:
- HTML error pages for browser requests
- Enhanced JSON with registration hints for API clients
- Link headers pointing to registration endpoints
This maintains OAuth 2.1 compliance (returns 400 for invalid client_id)
while providing actionable guidance to fix the error.
Nproviderr base_urlAnyHttpUrl | strr r r c s, t | t|d| _|| _|| _dS )aJ Initialize the enhanced authorization handler.
Args:
provider: OAuth authorization server provider
base_url: Base URL of the server for constructing endpoint URLs
server_name: Optional server name for branding
server_icon_url: Optional server icon URL for branding
/N)super__init__r rstrip _base_url _server_name_server_icon_url)selfr( r) r r __class__r% r& r- s
z AuthorizationHandler.__init__requestr r r c s t |I dH }|jdkrrd}|jdkr |jd}n| I dH }|d}t|tr0|}|rrz5t |dr_t
t |j
}|ddkrbd|d d
v re| |||d I dH W S W |S W |S W |S tyq Y |S w |S ) a Handle authorization request with enhanced error responses.
This method extends the SDK's authorization handler and intercepts
errors for unregistered clients to provide better error responses
based on the client's Accept header.
Args:
request: The authorization request
Returns:
Response (redirect on success, error response on failure)
N GETr bodyerrorinvalid_requestz not founderror_description state)r, handle status_codemethod query_paramsgetform
isinstancer hasattrjsonloadsbytesr8 lower _create_enhanced_error_response Exception)r2 r5 responser rC client_id_valuer8 r3 r% r& r> s<
zAuthorizationHandler.handler r r= c s4 | j d}| j d}ddlm} t|jjdd}t||r0|j}|j} | r-| d j nd}
n| j
}| j }
|j
dd} d | v rQt|||||
d
} t| d d }
n.dd
lm} |dd| d|d}|jdd}||d< ||d< ddlm} |d |ddid}
d| d|
j d < td |d | v rd |
S d |
S ) a5 Create enhanced error response with content negotiation.
Args:
request: The original request
client_id: The unregistered client ID
state: The state parameter from the request
Returns:
HTML or JSON error response based on Accept header
z /registerz'/.well-known/oauth-authorization-serverr )r fastmcp_serverNacceptr< z text/html)r r r r r r6 )r? )AuthorizationErrorResponser: z Client ID 'z' is not registered with this server. MCP clients should automatically re-register by sending a POST request to the registration_endpoint and retry authorization. If this persists, clear cached authentication tokens and reconnect.)r9 r; r= T) exclude_noner authorization_server_metadata) JSONResponsez
Cache-Controlzno-store)r? r headers; rel="http://oauth.net/core/2.1/#registration"Linkz5Unregistered client_id=%s, returned %s error responseHTMLJSON)r/ fastmcp.server.serverr getattrappr= rD nameiconssrcr0 r1 rT rB r' r
"mcp.server.auth.handlers.authorizerP
model_dumpstarlette.responsesrS loggerinfo)r2 r5 r r= r r r fastmcpr r] r rO r rL rP
error_data
error_dictrS r% r% r& rJ s^
z4AuthorizationHandler._create_enhanced_error_response)NN)r( r r) r* r r r r )r5 r r r )r5 r r r r= r r r )__name__
__module__ __qualname____doc__r- r> rJ
__classcell__r% r% r3 r& r s 1r )NNr )r r r r r r r r r r r r r r ) rj
__future__r rF typingr r_ r SDKAuthorizationHandlerpydanticr starlette.requestsr ra r fastmcp.utilities.loggingr fastmcp.utilities.uir r
r r r
mcp.server.auth.providerr rg rb r' r% r% r% r& s$
x