Add forward_resource flag to OAuthProxy (#3711)

Author: jlowin

src/fastmcp/server/auth/oauth_proxy/consent.py

@@ -285,8 +285,9 @@ def _build_upstream_authorize_url(
             query_params["code_challenge_method"] = "S256"
 
         # Forward resource indicator if present in transaction
-        if resource := transaction.get("resource"):
-            query_params["resource"] = resource
+        if self._forward_resource:
+            if resource := transaction.get("resource"):
+                query_params["resource"] = resource
 
         # Extra configured parameters
         if self._extra_authorize_params:

src/fastmcp/server/auth/oauth_proxy/proxy.py

@@ -248,6 +248,8 @@ def __init__(
         valid_scopes: list[str] | None = None,
         # PKCE configuration
         forward_pkce: bool = True,
+        # Resource indicator (RFC 8707)
+        forward_resource: bool = True,
         # Token endpoint authentication
         token_endpoint_auth_method: str | None = None,
         # Extra parameters to forward to authorization endpoint
@@ -382,6 +384,8 @@ def __init__(
 
         # PKCE configuration
         self._forward_pkce: bool = forward_pkce
+        # Resource indicator (RFC 8707)
+        self._forward_resource: bool = forward_resource
 
         # Token endpoint authentication
         self._token_endpoint_auth_method: str | None = token_endpoint_auth_method

src/fastmcp/server/auth/oidc_proxy.py

@@ -226,6 +226,7 @@ def __init__(
         # Consent screen configuration
         require_authorization_consent: bool | Literal["external"] = True,
         consent_csp_policy: str | None = None,
+        forward_resource: bool = True,
         # Extra parameters
         extra_authorize_params: dict[str, str] | None = None,
         extra_token_params: dict[str, str] | None = None,
@@ -377,6 +378,7 @@ def __init__(
             "token_endpoint_auth_method": token_endpoint_auth_method,
             "require_authorization_consent": require_authorization_consent,
             "consent_csp_policy": consent_csp_policy,
+            "forward_resource": forward_resource,
             "fallback_access_token_expiry_seconds": fallback_access_token_expiry_seconds,
             "enable_cimd": enable_cimd,
         }

src/fastmcp/server/auth/providers/auth0.py

@@ -73,6 +73,7 @@ def __init__(
         jwt_signing_key: str | bytes | None = None,
         require_authorization_consent: bool | Literal["external"] = True,
         consent_csp_policy: str | None = None,
+        forward_resource: bool = True,
     ) -> None:
         """Initialize Auth0 OAuth provider.
 
@@ -120,6 +121,7 @@ def __init__(
             jwt_signing_key=jwt_signing_key,
             require_authorization_consent=require_authorization_consent,
             consent_csp_policy=consent_csp_policy,
+            forward_resource=forward_resource,
         )
 
         logger.debug(

src/fastmcp/server/auth/providers/aws.py

@@ -111,6 +111,7 @@ def __init__(
         jwt_signing_key: str | bytes | None = None,
         require_authorization_consent: bool | Literal["external"] = True,
         consent_csp_policy: str | None = None,
+        forward_resource: bool = True,
     ):
         """Initialize AWS Cognito OAuth provider.
 
@@ -167,6 +168,7 @@ def __init__(
             jwt_signing_key=jwt_signing_key,
             require_authorization_consent=require_authorization_consent,
             consent_csp_policy=consent_csp_policy,
+            forward_resource=forward_resource,
         )
 
         logger.debug(

src/fastmcp/server/auth/providers/azure.py

@@ -112,6 +112,7 @@ def __init__(
         jwt_signing_key: str | bytes | None = None,
         require_authorization_consent: bool | Literal["external"] = True,
         consent_csp_policy: str | None = None,
+        forward_resource: bool = True,
         base_authority: str = "login.microsoftonline.com",
         http_client: httpx.AsyncClient | None = None,
         enable_cimd: bool = True,
@@ -248,6 +249,7 @@ def __init__(
             jwt_signing_key=jwt_signing_key,
             require_authorization_consent=require_authorization_consent,
             consent_csp_policy=consent_csp_policy,
+            forward_resource=forward_resource,
             valid_scopes=parsed_required_scopes,
             enable_cimd=enable_cimd,
         )

src/fastmcp/server/auth/providers/clerk.py

@@ -287,6 +287,7 @@ def __init__(
         jwt_signing_key: str | bytes | None = None,
         require_authorization_consent: bool | Literal["external"] = True,
         consent_csp_policy: str | None = None,
+        forward_resource: bool = True,
         extra_authorize_params: dict[str, str] | None = None,
         http_client: httpx.AsyncClient | None = None,
         enable_cimd: bool = True,
@@ -370,6 +371,7 @@ def __init__(
             jwt_signing_key=jwt_signing_key,
             require_authorization_consent=require_authorization_consent,
             consent_csp_policy=consent_csp_policy,
+            forward_resource=forward_resource,
             extra_authorize_params=extra_authorize_params_final or None,
             valid_scopes=parsed_valid_scopes,
             enable_cimd=enable_cimd,

src/fastmcp/server/auth/providers/discord.py

@@ -205,6 +205,7 @@ def __init__(
         jwt_signing_key: str | bytes | None = None,
         require_authorization_consent: bool | Literal["external"] = True,
         consent_csp_policy: str | None = None,
+        forward_resource: bool = True,
         http_client: httpx.AsyncClient | None = None,
         enable_cimd: bool = True,
     ):
@@ -272,6 +273,7 @@ def __init__(
             jwt_signing_key=jwt_signing_key,
             require_authorization_consent=require_authorization_consent,
             consent_csp_policy=consent_csp_policy,
+            forward_resource=forward_resource,
             enable_cimd=enable_cimd,
         )
 

src/fastmcp/server/auth/providers/github.py

@@ -220,6 +220,7 @@ def __init__(
         jwt_signing_key: str | bytes | None = None,
         require_authorization_consent: bool | Literal["external"] = True,
         consent_csp_policy: str | None = None,
+        forward_resource: bool = True,
         http_client: httpx.AsyncClient | None = None,
         enable_cimd: bool = True,
     ):
@@ -287,6 +288,7 @@ def __init__(
             jwt_signing_key=jwt_signing_key,
             require_authorization_consent=require_authorization_consent,
             consent_csp_policy=consent_csp_policy,
+            forward_resource=forward_resource,
             enable_cimd=enable_cimd,
         )
 

src/fastmcp/server/auth/providers/google.py

@@ -245,6 +245,7 @@ def __init__(
         jwt_signing_key: str | bytes | None = None,
         require_authorization_consent: bool | Literal["external"] = True,
         consent_csp_policy: str | None = None,
+        forward_resource: bool = True,
         extra_authorize_params: dict[str, str] | None = None,
         http_client: httpx.AsyncClient | None = None,
         enable_cimd: bool = True,
@@ -347,6 +348,7 @@ def __init__(
             jwt_signing_key=jwt_signing_key,
             require_authorization_consent=require_authorization_consent,
             consent_csp_policy=consent_csp_policy,
+            forward_resource=forward_resource,
             extra_authorize_params=extra_authorize_params_final,
             valid_scopes=valid_scopes_final,
             enable_cimd=enable_cimd,