# context_server: Handle bad WWW-Authenticate resource_metadata URLs \(\#53502\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/770e20c8390f9b12ef50fb84792c7b6ea7d654aa)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 770e20c8390f9b12ef50fb84792c7b6ea7d654aa

Requested commit: 770e20c8390f9b12ef50fb84792c7b6ea7d654aa

Commit: 770e20c8390f9b12ef50fb84792c7b6ea7d654aa

Tree: 92800b66469248ecd86e69aac8fbb6ffd433a8e6

Author: Tom Houlé

Committer: GitHub

## Message

```
context_server: Handle bad WWW-Authenticate resource_metadata URLs (#53502)

In MCP OAuth, when the resource_metadata URL from the WWW-Authenticate
header from the MCP server is on the same origin, but points to a broken
endpoint (for example Pydantic Logfire doubles the path component,
producing /mcp/mcp), fall back to the RFC 9728 well-known URIs instead
of failing outright. The header URL is still tried first, as per the MCP
spec.

Release Notes:

- MCP OAuth: Handle bad URLs in WWW-Authenticate by falling back to the
well known authorization server metadata URLs.
```

## Parents

- [68340172a1fa259b9f53541155eea9a3e9d6ec59](https://git.cafe/gitcafe/zed/commit/68340172a1fa259b9f53541155eea9a3e9d6ec59?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/770e20c8390f9b12ef50fb84792c7b6ea7d654aa?format=markdown)