Tinkering with test logic

Author: localden

samples/AuthorizationExample/Program.cs

@@ -12,7 +12,7 @@ public class Program
     public static async Task Main(string[] args)
     {
         // Define the MCP server endpoint that requires OAuth authentication
-        var serverEndpoint = new Uri("https://example.com/mcp");
+        var serverEndpoint = new Uri("http://localhost:7071/sse");
 
         // Set up the SSE transport with authorization support
         var transportOptions = new SseClientTransportOptions
@@ -21,7 +21,6 @@ public static async Task Main(string[] args)
             AuthorizeCallback = SseClientTransport.CreateLocalServerAuthorizeCallback(
                  openBrowser: async (url) =>
                  {
-                     // Open the URL in the user's default browser
                      Process.Start(new ProcessStartInfo(url) { UseShellExecute = true });
                  }
              )

samples/AuthorizationServerExample/Program.cs

@@ -24,7 +24,7 @@ public static async Task Main(string[] args)
         var prm = new ProtectedResourceMetadata
         {
             Resource = "http://localhost:7071", // Changed from HTTPS to HTTP for local development
-            AuthorizationServers = ["https://auth.example.com"], // Auth servers that can issue tokens for this resource
+            AuthorizationServers = ["https://login.microsoftonline.com/a2213e1c-e51e-4304-9a0d-effe57f31655/v2.0"], // Let's use a dummy Entra ID tenant here
             BearerMethodsSupported = ["header"], // We support the Authorization header
             ScopesSupported = ["mcp.tools", "mcp.prompts", "mcp.resources"], // Scopes supported by this resource
             ResourceDocumentation = "https://example.com/docs/mcp-server-auth" // Optional documentation URL

src/ModelContextProtocol/Protocol/Auth/AuthorizationContext.cs

@@ -85,7 +85,15 @@ public bool ValidateResourceUrl(string resourceUrl)
             return false;
         }
 
-        // Resource URL must match exactly
+        // Compare the host part (FQDN) rather than the full URL
+        if (Uri.TryCreate(resourceUrl, UriKind.Absolute, out Uri? resourceUri) && 
+            Uri.TryCreate(ResourceMetadata.Resource, UriKind.Absolute, out Uri? metadataUri))
+        {
+            // Compare only the host (domain name)
+            return string.Equals(resourceUri.Host, metadataUri.Host, StringComparison.OrdinalIgnoreCase);
+        }
+
+        // If we can't parse both URLs, fall back to exact string comparison
         return string.Equals(resourceUrl, ResourceMetadata.Resource, StringComparison.OrdinalIgnoreCase);
     }
 }

src/ModelContextProtocol/Protocol/Auth/DefaultAuthorizationHandler.cs

@@ -75,9 +75,11 @@ public async Task<bool> HandleUnauthorizedResponseAsync(HttpResponseMessage resp
             throw exception;
         }
 
+        // Store the resource metadata in the context before validating the resource URL
+        authContext.Value.ResourceMetadata = resourceMetadata;
+
         // Validate that the resource matches the server FQDN
-        if (!authContext.Value.ValidateResourceUrl(serverUri.ToString()) && 
-            !string.Equals(resourceMetadata.Resource, serverUri.ToString(), StringComparison.OrdinalIgnoreCase))
+        if (!authContext.Value.ValidateResourceUrl(serverUri.ToString()))
         {
             _logger.LogWarning("Resource URL mismatch: expected {Expected}, got {Actual}", 
                 serverUri, resourceMetadata.Resource);
@@ -87,8 +89,6 @@ public async Task<bool> HandleUnauthorizedResponseAsync(HttpResponseMessage resp
             throw exception;
         }
 
-        authContext.Value.ResourceMetadata = resourceMetadata;
-
         // Get the first authorization server from the metadata
         if (resourceMetadata.AuthorizationServers == null || resourceMetadata.AuthorizationServers.Length == 0)
         {