pomerium / pomerium / 23258806489

52%

Build Type

push

github

Committed by web-flow

Commit Message

fix(mcp): include request path in WWW-Authenticate resource_metadata URI (#6200)

## Summary

The resource_metadata URL in the WWW-Authenticate header was missing the
request path for path-based MCP servers, causing clients to fail OAuth
discovery due to a resource mismatch.

Per [RFC 9728
§5.1](https://datatracker.ietf.org/doc/html/rfc9728#section-5.1),
well-known URIs for path-based resources should include the path suffix.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Related issues

Fixes #6199

## User Explanation

When Pomerium returns a 401 for a path-based MCP server (e.g.
`https://example.com/mcp`), the `WWW-Authenticate` header now correctly
points to `/.well-known/oauth-protected-resource/mcp` instead of
`/.well-known/oauth-protected-resource`. This allows MCP clients (Gemini
CLI, Claude Code, etc.) to successfully complete OAuth discovery for
path-based MCP servers behind Pomerium.

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [x] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [x] ready for review

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

6 of 6 new or added lines in 2 files covered. (100.0%)

13 existing lines in 3 files now uncovered.

34863 of 76645 relevant lines covered (45.49%)

114.62 hits per line