|
2 | 2 |
|
3 | 3 | MCP supports OAuth 2.1 authentication for protecting server resources. This section demonstrates both server-side token verification and client-side authentication flows. |
4 | 4 |
|
| 5 | +## Security considerations |
| 6 | + |
| 7 | +When implementing authentication: |
| 8 | + |
| 9 | +- **Use HTTPS**: All OAuth flows must use HTTPS in production |
| 10 | +- **Token validation**: Always validate tokens on the resource server side |
| 11 | +- **Scope checking**: Verify that tokens have required scopes |
| 12 | +- **Introspection**: Use token introspection for distributed validation |
| 13 | +- **RFC compliance**: Follow RFC 9728 for proper authoriazation server (AS) discovery |
| 14 | + |
| 15 | +## OAuth architecture |
| 16 | + |
| 17 | +The MCP OAuth implementation follows the OAuth 2.1 authorization code flow with token introspection: |
| 18 | + |
| 19 | +```mermaid |
| 20 | +sequenceDiagram |
| 21 | + participant C as Client |
| 22 | + participant AS as Authorization Server |
| 23 | + participant RS as Resource Server<br/>(MCP Server) |
| 24 | + participant U as User |
| 25 | +
|
| 26 | + Note over C,RS: 1. Discovery Phase (RFC 9728) |
| 27 | + C->>RS: GET /.well-known/oauth-protected-resource |
| 28 | + RS->>C: Protected Resource Metadata<br/>(issuer, scopes, etc.) |
| 29 | +
|
| 30 | + Note over C,AS: 2. Authorization Phase |
| 31 | + C->>AS: GET /authorize?response_type=code&client_id=... |
| 32 | + AS->>U: Redirect to login/consent |
| 33 | + U->>AS: User authenticates and consents |
| 34 | + AS->>C: Authorization code (via redirect) |
| 35 | +
|
| 36 | + Note over C,AS: 3. Token Exchange |
| 37 | + C->>AS: POST /token<br/>(authorization_code grant) |
| 38 | + AS->>C: Access token + refresh token |
| 39 | +
|
| 40 | + Note over C,RS: 4. Resource Access |
| 41 | + C->>RS: MCP request + Authorization: Bearer <token> |
| 42 | + RS->>AS: POST /introspect<br/>(validate token) |
| 43 | + AS->>RS: Token info (active, scopes, user) |
| 44 | + RS->>C: MCP response (if authorized) |
| 45 | +
|
| 46 | + Note over C,AS: 5. Token Refresh (when needed) |
| 47 | + C->>AS: POST /token<br/>(refresh_token grant) |
| 48 | + AS->>C: New access token |
| 49 | +``` |
| 50 | + |
| 51 | +**Components:** |
| 52 | + |
| 53 | +- **Authorization Server (AS)**: Handles OAuth flows, issues and validates tokens |
| 54 | +- **Resource Server (RS)**: Your MCP server that validates tokens and serves protected resources |
| 55 | +- **Client**: Discovers AS through RFC 9728, obtains tokens, and uses them with MCP server |
| 56 | +- **User**: Resource owner who authorizes access |
| 57 | + |
5 | 58 | ## OAuth server implementation |
6 | 59 |
|
7 | 60 | FastMCP server with OAuth token verification: |
@@ -89,58 +142,3 @@ This example shows: |
89 | 142 | - Support for non-RFC 9728 compliant clients |
90 | 143 | - Legacy endpoint compatibility |
91 | 144 | - Migration patterns for existing systems |
92 | | - |
93 | | -## OAuth architecture |
94 | | - |
95 | | -The MCP OAuth implementation follows the OAuth 2.1 authorization code flow with token introspection: |
96 | | - |
97 | | -```mermaid |
98 | | -sequenceDiagram |
99 | | - participant C as Client |
100 | | - participant AS as Authorization Server |
101 | | - participant RS as Resource Server<br/>(MCP Server) |
102 | | - participant U as User |
103 | | -
|
104 | | - Note over C,RS: 1. Discovery Phase (RFC 9728) |
105 | | - C->>RS: GET /.well-known/oauth-protected-resource |
106 | | - RS->>C: Protected Resource Metadata<br/>(issuer, scopes, etc.) |
107 | | - |
108 | | - Note over C,AS: 2. Authorization Phase |
109 | | - C->>AS: GET /authorize?response_type=code&client_id=... |
110 | | - AS->>U: Redirect to login/consent |
111 | | - U->>AS: User authenticates and consents |
112 | | - AS->>C: Authorization code (via redirect) |
113 | | - |
114 | | - Note over C,AS: 3. Token Exchange |
115 | | - C->>AS: POST /token<br/>(authorization_code grant) |
116 | | - AS->>C: Access token + refresh token |
117 | | - |
118 | | - Note over C,RS: 4. Resource Access |
119 | | - C->>RS: MCP request + Authorization: Bearer <token> |
120 | | - RS->>AS: POST /introspect<br/>(validate token) |
121 | | - AS->>RS: Token info (active, scopes, user) |
122 | | - RS->>C: MCP response (if authorized) |
123 | | - |
124 | | - Note over C,AS: 5. Token Refresh (when needed) |
125 | | - C->>AS: POST /token<br/>(refresh_token grant) |
126 | | - AS->>C: New access token |
127 | | -``` |
128 | | - |
129 | | -**Components:** |
130 | | - |
131 | | -- **Authorization Server (AS)**: Handles OAuth flows, issues and validates tokens |
132 | | -- **Resource Server (RS)**: Your MCP server that validates tokens and serves protected resources |
133 | | -- **Client**: Discovers AS through RFC 9728, obtains tokens, and uses them with MCP server |
134 | | -- **User**: Resource owner who authorizes access |
135 | | - |
136 | | -## Security considerations |
137 | | - |
138 | | -When implementing authentication: |
139 | | - |
140 | | -1. **Use HTTPS**: All OAuth flows must use HTTPS in production |
141 | | -2. **Token validation**: Always validate tokens on the resource server side |
142 | | -3. **Scope checking**: Verify that tokens have required scopes |
143 | | -4. **Introspection**: Use token introspection for distributed validation |
144 | | -5. **RFC compliance**: Follow RFC 9728 for proper AS discovery |
145 | | - |
146 | | -These examples provide a complete OAuth 2.1 implementation suitable for production use with proper security practices. |
0 commit comments