Prefer external URL in WWW-Authenticate header for RFC 9728#169658
Open
allenporter wants to merge 2 commits intohome-assistant:devfrom
Open
Prefer external URL in WWW-Authenticate header for RFC 9728#169658allenporter wants to merge 2 commits intohome-assistant:devfrom
allenporter wants to merge 2 commits intohome-assistant:devfrom
Conversation
Update the HTTP view request handler to use `prefer_external=True` when generating the resource metadata URL in the `WWW-Authenticate` header. This ensures that remote OAuth clients (such as MCP clients) can correctly locate authentication information, even when Home Assistant is accessed via an internal URL that might not be reachable by the client. This is working around a larger issue related to port matching against the urls. - Add comprehensive regression tests in `test_view.py` for URL matching. - Refactor `test_view.py` to use a cleaner, fixture-based approach for mocking the current request context.
home-assistant
Bot
added
bugfix
cla-signed
code-quality
core
has-tests
integration: http
small-pr
Contributor
|
Hey there @home-assistant/core, mind taking a look at this pull request as it has been labeled with an integration ( Code owner commandsCode owners of
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the HTTP request handler’s WWW-Authenticate header generation (RFC 9728 resource metadata link) to prefer the external URL, and adds regression tests to validate URL selection behavior.
Changes:
- Call
get_url(..., prefer_external=True)when building theresource_metadataURL forWWW-Authenticate. - Add/extend tests in
tests/components/http/test_view.pyto cover URL selection across internal/external configurations. - Introduce a fixture to set the current request context for these tests.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
homeassistant/helpers/http.py |
Forces external-preferred URL selection when building RFC 9728 resource_metadata in WWW-Authenticate. |
tests/components/http/test_view.py |
Adds a request-context fixture and parametrized tests for WWW-Authenticate URL selection. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed change
Update the HTTP view request handler to use
prefer_external=Truewhen generating the resource metadata URL in theWWW-Authenticateheader. This ensures that remote OAuth clients (targeted at MCP clients) can correctly locate authentication information.This is working around a larger issue related to port matching that I am looking at in #169654. This is a smaller scoped changed for
WWW-Authenticateto reduce the scope.Chagnes:
test_view.pyfor URL matching.test_view.pyto use a cleaner, fixture-based approach for mocking the current request context.Type of change
Additional information
Checklist
ruff format homeassistant tests)If user exposed functionality or configuration variables are added/changed:
If the code communicates with devices, web services, or third-party tools:
Updated and included derived files by running:
python3 -m script.hassfest.requirements_all.txt.Updated by running
python3 -m script.gen_requirements_all.To help with the load of incoming pull requests: