mcp-server: added servlet context path to resource_metadata header

Author: fmgit00

mcp-server-security/src/main/java/org/springaicommunity/mcp/security/server/oauth2/authentication/BearerResourceMetadataTokenAuthenticationEntryPoint.java

@@ -63,7 +63,8 @@ public void commence(HttpServletRequest request, HttpServletResponse response,
 
 	private String buildResourceMetadataPath(HttpServletRequest request, ResourceIdentifier resourceIdentifier) {
 		return UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request))
-			.replacePath("/.well-known/oauth-protected-resource" + resourceIdentifier.getPath())
+			.replacePath(
+					request.getContextPath() + "/.well-known/oauth-protected-resource" + resourceIdentifier.getPath())
 			.replaceQuery(null)
 			.fragment(null)
 			.toUriString();

mcp-server-security/src/main/java/org/springaicommunity/mcp/security/server/oauth2/metadata/ResourceIdentifier.java

@@ -43,7 +43,7 @@ public String getResource() {
 		var request = requestAttributes.getRequest();
 
 		return UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request))
-			.replacePath(this.getPath())
+			.replacePath(request.getContextPath() + this.getPath())
 			.replaceQuery(null)
 			.fragment(null)
 			.toUriString();

mcp-server-security/src/test/java/org/springaicommunity/mcp/security/server/oauth2/authentication/BearerResourceMetadataTokenAuthenticationEntryPointTest.java

@@ -0,0 +1,84 @@
+package org.springaicommunity.mcp.security.server.oauth2.authentication;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springaicommunity.mcp.security.server.oauth2.metadata.ResourceIdentifier;
+import org.springframework.http.HttpHeaders;
+import org.springframework.security.core.AuthenticationException;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+class BearerResourceMetadataTokenAuthenticationEntryPointTest {
+
+	private HttpServletRequest request;
+
+	private HttpServletResponse response;
+
+	private ResourceIdentifier resourceIdentifier;
+
+	private BearerResourceMetadataTokenAuthenticationEntryPoint entryPoint;
+
+	@BeforeEach
+	void setUp() {
+		request = mock(HttpServletRequest.class);
+		response = mock(HttpServletResponse.class);
+		resourceIdentifier = mock(ResourceIdentifier.class);
+		when(resourceIdentifier.getPath()).thenReturn("/mcp");
+		entryPoint = new BearerResourceMetadataTokenAuthenticationEntryPoint(resourceIdentifier);
+	}
+
+	@Test
+	void commence_ShouldAddCustomContextPath() throws Exception {
+		when(request.getContextPath()).thenReturn("/foo");
+		when(request.getScheme()).thenReturn("https");
+		when(request.getServerName()).thenReturn("my.host.com");
+		when(request.getServerPort()).thenReturn(443);
+		when(request.getRequestURI()).thenReturn("/foo/some/endpoint");
+		when(request.getQueryString()).thenReturn(null);
+
+		when(response.getHeader(HttpHeaders.WWW_AUTHENTICATE)).thenReturn("Bearer");
+
+		AuthenticationException authException = mock(AuthenticationException.class);
+
+		entryPoint.commence(request, response, authException);
+
+		ArgumentCaptor<String> captor = ArgumentCaptor.forClass(String.class);
+		verify(response).setHeader(eq(HttpHeaders.WWW_AUTHENTICATE), captor.capture());
+
+		String headerValue = captor.getValue();
+		assertThat(headerValue)
+			.contains("Bearer resource_metadata=https://my.host.com/foo/.well-known/oauth-protected-resource/mcp");
+	}
+
+	@Test
+	void commence_ShouldAddDefaultContextPath() throws Exception {
+		when(request.getContextPath()).thenReturn("/");
+		when(request.getScheme()).thenReturn("https");
+		when(request.getServerName()).thenReturn("my.host.com");
+		when(request.getServerPort()).thenReturn(443);
+		when(request.getRequestURI()).thenReturn("/some/endpoint");
+		when(request.getQueryString()).thenReturn(null);
+
+		when(response.getHeader(HttpHeaders.WWW_AUTHENTICATE)).thenReturn("Bearer");
+
+		AuthenticationException authException = mock(AuthenticationException.class);
+
+		entryPoint.commence(request, response, authException);
+
+		ArgumentCaptor<String> captor = ArgumentCaptor.forClass(String.class);
+		verify(response).setHeader(eq(HttpHeaders.WWW_AUTHENTICATE), captor.capture());
+
+		String headerValue = captor.getValue();
+		assertThat(headerValue)
+			.contains("Bearer resource_metadata=https://my.host.com/.well-known/oauth-protected-resource/mcp");
+	}
+
+}

mcp-server-security/src/test/java/org/springaicommunity/mcp/security/server/oauth2/metadata/ResourceIdentifierTest.java

@@ -0,0 +1,62 @@
+package org.springaicommunity.mcp.security.server.oauth2.metadata;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.BDDAssertions.catchThrowable;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+class ResourceIdentifierTest {
+
+	@AfterEach
+	void tearDown() {
+		RequestContextHolder.resetRequestAttributes();
+	}
+
+	@Test
+	void constructor_ShouldThrowException_WhenPathIsEmpty() {
+		// when
+		Throwable thrown = catchThrowable(() -> new ResourceIdentifier(""));
+
+		// then
+		assertThat(thrown).isInstanceOf(IllegalArgumentException.class).hasMessageContaining("path cannot be empty");
+	}
+
+	@Test
+	void getPath_ShouldReturnGivenPath() {
+		// given
+		var identifier = new ResourceIdentifier("/my-resource");
+
+		// then
+		assertThat(identifier.getPath()).isEqualTo("/my-resource");
+	}
+
+	@Test
+	void getResource_ShouldBuildFullUrlBasedOnCurrentRequest() {
+		// given
+		HttpServletRequest request = mock(HttpServletRequest.class);
+		when(request.getScheme()).thenReturn("https");
+		when(request.getServerName()).thenReturn("my.host.com");
+		when(request.getServerPort()).thenReturn(8443);
+		when(request.getContextPath()).thenReturn("/foo");
+		when(request.getRequestURI()).thenReturn("/foo/other/path");
+		when(request.getQueryString()).thenReturn(null);
+
+		RequestContextHolder.setRequestAttributes(new ServletRequestAttributes(request));
+
+		var identifier = new ResourceIdentifier("/mcp");
+
+		// when
+		String result = identifier.getResource();
+
+		// then
+		assertThat(result).isEqualTo("https://my.host.com:8443/foo/mcp");
+	}
+
+}