Client Auth: Resource Parameter Validation

[pcarleton]

Overview

Add conformance tests for OAuth Resource Indicators (RFC 8707) implementation, ensuring clients correctly specify target resources and use canonical server URIs.

Specification References

• Resource Parameter Implementation
• Canonical Server URI
• Protected Resource Metadata Discovery Requirements
• RFC 8707 - Resource Indicators for OAuth 2.0
• RFC 9728 Section 3 - Protected Resource Metadata

Key Requirements from Specification

Resource Parameter (MUST)

• Clients MUST implement Resource Indicators per RFC 8707
• resource parameter MUST be included in both authorization and token requests
• resource parameter MUST identify the MCP server the client intends to use the token with
• resource parameter MUST use the canonical URI of the MCP server
• Clients MUST send this parameter regardless of whether authorization servers support it

Canonical Server URI (SHOULD)

• Clients SHOULD provide the most specific URI for the MCP server
• Canonical form uses lowercase scheme and host components
• Implementations SHOULD accept uppercase scheme/host for robustness

Resource Identifier Options

The resource identifier can be either:

1. The full MCP request URL (e.g., https://mcp.example.com/public/mcp)
2. The base URL (e.g., https://mcp.example.com)

This aligns with the resource parameter in RFC 9728 and the Protected Resource Metadata discovery requirements.

Valid Canonical URI Examples

• https://mcp.example.com/mcp
• https://mcp.example.com
• https://mcp.example.com:8443
• https://mcp.example.com/server/mcp

Invalid Canonical URI Examples

• mcp.example.com (missing scheme)
• https://mcp.example.com#fragment (contains fragment)

URI Trailing Slash

• Both https://mcp.example.com/ and https://mcp.example.com are valid
• Implementations SHOULD consistently use form without trailing slash unless semantically significant

Scenarios to Cover

Positive Tests

1. Client includes resource parameter in authorization request
2. Client includes resource parameter in token request
3. Client uses correct canonical URI format (full MCP request URL)
4. Client uses correct canonical URI format (base URL)
5. Client handles URIs with port numbers correctly
6. Client handles URIs with path components correctly
7. Client normalizes scheme and host to lowercase

Negative Tests

1. Client omits resource parameter from authorization request
2. Client omits resource parameter from token request
3. Client uses invalid URI (missing scheme)
4. Client uses invalid URI (contains fragment)
5. Client uses inconsistent URIs between requests
6. Client fails to normalize canonical URI properly

Implementation Notes

• Register spec references in src/scenarios/client/auth/spec-references.ts
• Build on existing auth scenarios in src/scenarios/client/auth/
• Follow patterns from basic-dcr.ts and basic-metadata.ts
• Include at least one negative test scenario per requirement
• Test both full URL and base URL as resource identifiers

Acceptance Criteria

• Test scenarios cover resource parameter implementation per spec
• Test scenarios cover canonical server URI requirements
• Tests validate resource parameter presence in both authorization and token requests
• Tests verify correct URI format and normalization
• Tests cover both full MCP request URL and base URL as resource identifiers
• At least one negative test included for each major requirement
• Spec references registered in check definitions file
• All checks properly documented and follow existing patterns

[pcarleton]

Suggested Check Slugs

Based on conformance coverage analysis, here are the suggested check IDs:

Check Slug	Description	Spec Requirement
resource-param-in-authz	Verify client sends resource in authorization request	"The resource parameter: MUST be included in both authorization requests and token requests."
resource-param-in-token	Verify client sends resource in token request	"The resource parameter: MUST be included in both authorization requests and token requests."
resource-param-canonical-uri	Verify resource uses canonical URI of MCP server	"The resource parameter: MUST use the canonical URI of the MCP server"
resource-param-identifies-server	Verify resource correctly identifies target server	"The resource parameter: MUST identify the MCP server that the client intends to use the token with."

Exact Spec Language

Resource Parameter Implementation

Keyword	Statement
MUST	MCP clients MUST implement Resource Indicators for OAuth 2.0
MUST	The resource parameter: MUST be included in both authorization requests and token requests.
MUST	The resource parameter: MUST identify the MCP server that the client intends to use the token with.
MUST	The resource parameter: MUST use the canonical URI of the MCP server
MUST	MCP clients MUST send this parameter regardless of whether authorization servers support it.

Token Audience Binding and Validation

Keyword	Statement
MUST	MCP clients MUST include the resource parameter in authorization and token requests

Access Token Privilege Restriction

Keyword	Statement
MUST	MCP clients MUST implement and use the resource parameter