Fix redirect_uri handling

Author: praboud-ant

src/mcp/server/auth/handlers/authorize.py

@@ -197,6 +197,7 @@ async def error_response(
                 scopes=scopes,
                 code_challenge=auth_request.code_challenge,
                 redirect_uri=redirect_uri,
+                redirect_uri_provided_explicitly=auth_request.redirect_uri is not None,
             )
 
             try:

src/mcp/server/auth/handlers/token.py

@@ -25,7 +25,7 @@ class AuthorizationCodeRequest(BaseModel):
     grant_type: Literal["authorization_code"]
     code: str = Field(..., description="The authorization code")
     redirect_uri: AnyHttpUrl | None = Field(
-        ..., description="Must be the same as redirect URI provided in /authorize"
+        None, description="Must be the same as redirect URI provided in /authorize"
     )
     client_id: str
     # we use the client_secret param, per https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1
@@ -158,7 +158,8 @@ async def handle(self, request: Request):
 
                 # verify redirect_uri doesn't change between /authorize and /tokens
                 # see https://datatracker.ietf.org/doc/html/rfc6749#section-10.6
-                if token_request.redirect_uri != auth_code.redirect_uri:
+                authorize_request_redirect_uri = auth_code.redirect_uri if auth_code.redirect_uri_provided_explicitly else None
+                if token_request.redirect_uri != authorize_request_redirect_uri:
                     return self.response(
                         TokenErrorResponse(
                             error="invalid_request",

src/mcp/server/auth/provider.py

@@ -11,10 +11,11 @@
 
 
 class AuthorizationParams(BaseModel):
-    state: str | None = None
-    scopes: list[str] | None = None
+    state: str | None
+    scopes: list[str] | None
     code_challenge: str
     redirect_uri: AnyHttpUrl
+    redirect_uri_provided_explicitly: bool
 
 
 class AuthorizationCode(BaseModel):
@@ -24,6 +25,7 @@ class AuthorizationCode(BaseModel):
     client_id: str
     code_challenge: str
     redirect_uri: AnyHttpUrl
+    redirect_uri_provided_explicitly: bool
 
 
 class RefreshToken(BaseModel):

tests/server/fastmcp/auth/test_auth_integration.py

@@ -64,6 +64,7 @@ async def authorize(
             client_id=client.client_id,
             code_challenge=params.code_challenge,
             redirect_uri=params.redirect_uri,
+            redirect_uri_provided_explicitly=params.redirect_uri_provided_explicitly,
             expires_at=time.time() + 300,
             scopes=params.scopes or ["read", "write"],
         )