auth

Mar 31, 2026

Changes in this version

+ func GetAuthServerMetadata(ctx context.Context, issuerURL string, httpClient *http.Client) (*oauthex.AuthServerMeta, error)

+ type AuthorizationArgs struct

+ URL string

+ type AuthorizationCodeFetcher func(ctx context.Context, args *AuthorizationArgs) (*AuthorizationResult, error)

+ type AuthorizationCodeHandler struct

+ func NewAuthorizationCodeHandler(config *AuthorizationCodeHandlerConfig) (*AuthorizationCodeHandler, error)

+ func (h *AuthorizationCodeHandler) Authorize(ctx context.Context, req *http.Request, resp *http.Response) error

+ func (h *AuthorizationCodeHandler) TokenSource(ctx context.Context) (oauth2.TokenSource, error)

+ type AuthorizationCodeHandlerConfig struct

+ AuthorizationCodeFetcher AuthorizationCodeFetcher

+ Client *http.Client

+ ClientIDMetadataDocumentConfig *ClientIDMetadataDocumentConfig

+ DynamicClientRegistrationConfig *DynamicClientRegistrationConfig

+ PreregisteredClient *oauthex.ClientCredentials

+ RedirectURL string

+ type AuthorizationResult struct

+ Code string

+ State string

+ type ClientIDMetadataDocumentConfig struct

+ URL string

+ type DynamicClientRegistrationConfig struct

+ Metadata *oauthex.ClientRegistrationMetadata

Feb 27, 2026 GO-2026-4770 +1 more

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Changes in this version

+ type OAuthHandler interface

+ Authorize func(context.Context, *http.Request, *http.Response) error

+ TokenSource func(context.Context) (oauth2.TokenSource, error)

Feb 18, 2026 GO-2026-4770 +1 more

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Jan 25, 2026 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Jan 25, 2026 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Dec 19, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Changes in this version

+ func ProtectedResourceMetadataHandler(metadata *oauthex.ProtectedResourceMetadata) http.Handler

type TokenInfo

+ UserID string

Dec 19, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Dec 12, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Oct 29, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Oct 29, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Oct 23, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Sep 30, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Sep 26, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Sep 24, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Sep 19, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Sep 12, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Sep 5, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Changes in this version

+ var ErrOAuth = errors.New("oauth error")

Aug 29, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Aug 22, 2025 GO-2026-4569 +2 more

  GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

  GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

  GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Changes in this version

+ var ErrInvalidToken = errors.New("invalid token")

+ func RequireBearerToken(verifier TokenVerifier, opts *RequireBearerTokenOptions) func(http.Handler) http.Handler

+ type RequireBearerTokenOptions struct

+ ResourceMetadataURL string

+ Scopes []string

+ type TokenInfo struct

+ Expiration time.Time

+ Extra map[string]any

+ Scopes []string

+ func TokenInfoFromContext(ctx context.Context) *TokenInfo

+ type TokenVerifier func(ctx context.Context, token string) (*TokenInfo, error)