OAuth discovery rejects cross-origin resource_metadata from WWW-Authenticate, breaking centralized PRM (SEP-985) deployments

[pablozamudio]

Describe the bug
AuthorizationManager::resolve_resource_metadata_url (crates/rmcp/src/transport/auth.rs) unconditionally discards a resource_metadata URL from a WWW-Authenticate challenge when it is not same-origin (scheme+host+port) with the MCP resource:

https://github.com/modelcontextprotocol/rust-sdk/blob/main/crates/rmcp/src/transport/auth.rs

fn resolve_resource_metadata_url(value: &str, base_url: &Url) -> Option<Url> {
    ...
    if Self::is_same_origin_resource_metadata_url(base_url, &url) {
        Some(url)
    } else {
        warn!("rejecting resource metadata URL `{url}` because it is not same-origin with `{base_url}`");
        None
    }
}

This check was introduced in #935 (SSRF hardening) and is still present, unchanged and with no opt-out, on main today.

SEP-985 (tracked in #517, closed as implemented) explicitly asks the SDK to support protected-resource-metadata discovery via the resource_metadata parameter in the WWW-Authenticate challenge. That parameter is designed to point at a centralized protected-resource-metadata (PRM) endpoint, which is commonly on a different origin than the MCP resource itself — one PRM host serving metadata for many resource servers, each of which then names its own (also possibly different-origin) authorization server. The same-origin check added in #935 rejects exactly this shape unconditionally, before the authorization_servers value is ever read. There is currently no way to opt into accepting a cross-origin resource_metadata pointer — no builder method, no flag, nothing in AuthorizationManager or OAuthState addresses this specific check.

To Reproduce
Steps to reproduce the behavior:

1. Stand up a resource server that returns 401 with WWW-Authenticate: Bearer resource_metadata="<url on a different origin than the resource>".
2. Have that URL serve valid protected-resource metadata naming an authorization_servers entry (on any origin).
3. Call AuthorizationManager::discover_metadata() (or the equivalent OAuthState discovery flow) against the resource.
4. Observe that resolve_resource_metadata_url logs rejecting resource metadata URL ... because it is not same-origin and discovery falls through without ever fetching the PRM document or the authorization server metadata.

A self-contained, dependency-free Python reproducer using three loopback-only mock servers (resource / centralized PRM / authorization server) that mirrors this exact topology is available here: openai/codex#42427 (comment)

A real-world case with no mocks: https://api.anthropic.com/v1/design/mcp advertises resource_metadata at https://api.anthropic.com/v1/design/.well-known/oauth-protected-resource, which in turn names https://claude.ai/v1/design/mcp as the authorization server — a different origin from the MCP resource.

Expected behavior
The resource_metadata URL should be followed regardless of origin (subject to the same SSRF allowlist/denylist already applied to authorization-server metadata URLs, e.g. is_disallowed_metadata_host), so that a legitimate centralized PRM host — the deployment shape SEP-985 was written to support — resolves its authorization_servers and completes discovery, instead of being discarded unconditionally.

Logs

[rmcp] warn: rejecting resource metadata URL `https://<prm-host>/.well-known/oauth-protected-resource` because it is not same-origin with `https://<resource-host>/mcp`

Downstream effect in a consuming client (openai/codex), also blocked by this: openai/codex#42427

Additional context

• This is blocking OAuth login in openai/codex, which uses this SDK for its MCP OAuth client. Claude Code and Qwen Code both complete OAuth against the api.anthropic.com/claude.ai example above; Codex cannot, purely because this SDK never reaches the point of reading authorization_servers.
• Suggested fix: rather than a binary same-origin requirement on the resource_metadata URL itself, apply the same SSRF allowlist/denylist already used for authorization-server metadata URLs (is_disallowed_metadata_host) to the resolved resource_metadata URL as well. That preserves the SSRF protection fix: block oauth metadata ssrf #935 was added for while allowing the legitimate cross-origin PRM case.

[ndreno]

+1 on dropping the unconditional same-origin requirement. SEP-985 exists for centralized PRM, and the api.anthropic.com → claude.ai case shows it is a real deployment shape, not an edge case.

One constraint on the approach, which #1302 now implements. is_disallowed_metadata_host evaluates the URL's host string: for a DNS name it returns "allowed" without resolving it, so it does not constrain the address the client actually connects to. The same-origin check is stronger than it looks for exactly that reason, it does not depend on DNS at all. Relaxing it to the host denylist alone trades a DNS-independent control for a name-based one.

I would pair the relaxation with enforcement on the resolved address: a reqwest::dns::Resolve implementation on both discovery clients (follow_redirects and stop_redirects) that filters resolved IPs through the existing is_disallowed_metadata_ipv4 and is_disallowed_metadata_ipv6 predicates, keeping today's loopback exception for local development. Checking at resolution also covers rebinding, since the policy applies to the address actually dialled rather than to a lookup made earlier.

Tests worth adding: a cross-origin public PRM resolves and completes discovery; a hostname resolving to a link-local or private address is rejected; the loopback-to-loopback development case still works.

I have sent a related report through the security advisory process (GHSA-5p52-q7pq-9fq2). It bears directly on #1302, so it is worth reading before that one merges. Happy to implement the resolver-level check.