fix: treat resource metadata JSON parse failure as soft error (#810)

In fetch_resource_metadata_from_url, a JSON parse failure on the
response body caused a fatal AuthError::MetadataError, preventing
discover_metadata() from falling through to direct
.well-known/oauth-authorization-server discovery (Strategy B).

MCP servers that return HTTP 200 with non-JSON content (e.g. HTML)
at their base URL caused the OAuth flow to abort entirely, even
when the server had a valid .well-known/oauth-authorization-server
endpoint.

Return Ok(None) on parse failure, consistent with how HTTP errors
are already handled in the same function.
This commit is contained in:
jh-block 2026-04-16 18:16:19 +02:00 committed by GitHub
parent 3e56d52764
commit 01a6666429
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -1609,12 +1609,13 @@ impl AuthorizationManager {
return Ok(None);
}
let metadata = response
.json::<ResourceServerMetadata>()
.await
.map_err(|e| {
AuthError::MetadataError(format!("Failed to parse resource metadata: {}", e))
})?;
let metadata = match response.json::<ResourceServerMetadata>().await {
Ok(metadata) => metadata,
Err(e) => {
debug!("failed to parse resource metadata as JSON: {}", e);
return Ok(None);
}
};
Ok(Some(metadata))
}