[Server] Oauth2 based on middleware by sveneld · Pull Request #221 · modelcontextprotocol/php-sdk

sveneld · 2026-01-12T11:43:41Z

Motivation and Context

Implementation of OAuth based on middlewares from #218

How Has This Been Tested?

Breaking Changes

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

Additional context

Fix #214

…into middleware

chr-hertel · 2026-01-18T21:24:31Z

Thanks @sveneld - it will take some time for me to give some proper feedback here, just to let you know - needs quite some focus & attention - still really appreciated!

chr-hertel

Hi again @sveneld! This is great already - went to a first round of very detailed review directly. Thanks again for working on this! 🙏

Didn't manage to go through all, but dropping the first round of comments.

sveneld · 2026-01-28T15:33:08Z

@chr-hertel I updated pull request

Nyholm · 2026-02-11T19:34:32Z

Can you please rebase this now when the Middleware Handler is merged?

Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com>

sveneld · 2026-02-11T19:59:24Z

Can you please rebase this now when the Middleware Handler is merged?

Done.

Nyholm

Great. Looks good.

I only have small things to comment at. I have not tested it out.

sveneld · 2026-02-16T18:45:25Z

I have updated the pull request, but I am not satisfied with the result. I need more time to rethink the flow and improve the implementation.

chr-hertel · 2026-02-17T23:26:51Z

@sveneld anything in particular you would need feedback here?
can tell you about nit picks already, e.g. using Mcp\Exception\*Exception classes instead of built-in ones

sveneld · 2026-02-18T12:03:19Z

Thank you, no feedback needed.

sveneld · 2026-02-22T11:43:14Z

@chr-hertel take a look.

…nversion Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com>

chr-hertel · 2026-02-26T20:00:59Z

@chr-hertel take a look.

@sveneld will do so this weekend - thanks! 👍

chr-hertel

Hi @sveneld, getting into polishing here I feel - thanks again for your work! Pretty sure i missed some parts, but you get the overall vibe of my review i guess.

Could you as well add some docs, especially what users would need to enable this feature? or could be a follow up PR if you like

…into oauth_middleware # Conflicts: # composer.json # examples/server/oauth-keycloak/Dockerfile # examples/server/oauth-keycloak/McpElements.php # examples/server/oauth-keycloak/README.md # examples/server/oauth-keycloak/docker-compose.yml # examples/server/oauth-keycloak/server.php # examples/server/oauth-microsoft/Dockerfile # examples/server/oauth-microsoft/McpElements.php # examples/server/oauth-microsoft/README.md # examples/server/oauth-microsoft/docker-compose.yml # examples/server/oauth-microsoft/server.php # src/Server/Transport/StreamableHttpTransport.php

sveneld · 2026-03-02T12:38:25Z

@chr-hertel I’ve updated the pull request. If everything looks good, I’ll rebase and squash the commits.

sveneld · 2026-03-09T11:18:02Z

@chr-hertel should i change something else?

chr-hertel · 2026-03-09T14:18:29Z

@sveneld can you please double check the diff - feels a bit bloated, see Mcp\Server\Transport\Middleware vs. Mcp\Server\Transport\Http\Middleware

Remove old Mcp\Server\Transport\Middleware\ classes that were duplicated in Mcp\Server\Transport\Http\Middleware\ and Http\OAuth\. Update docs to reference the correct namespaces.

sveneld · 2026-03-09T15:44:20Z

@chr-hertel I reviewed the diff — you were right, the Mcp\Server\Transport\Middleware namespace was a leftover that duplicated classes already present in Mcp\Server\Transport\Http\Middleware and Mcp\Server\Transport\Http\OAuth.

Removed the duplicate namespace and updated the docs accordingly. The diff should be clean now.

…add JSON_THROW_ON_ERROR - JwtTokenValidator: replace catch(\Throwable) with explicit \InvalidArgumentException|\UnexpectedValueException|\DomainException, letting RuntimeException from JwksProvider propagate as infrastructure errors - OAuthProxyMiddleware: add \JSON_THROW_ON_ERROR to json_encode for metadata response - Update tests to expect RuntimeException for JWKS infrastructure failures

chr-hertel

Thanks a ton @sveneld - I know it really took some effort and loops with all those changes! Thanks for your patience and endurance! 🥳

Volodymyr Panivko and others added 3 commits December 29, 2025 16:04

Add Middleware handlers to StreamableHttpTransport

6988e5b

Merge branch 'main' of https://github.com/modelcontextprotocol/php-sdk …

af2b28b

…into middleware

OAuth Implementation based on middleware

6ac6671

sveneld requested review from CodeWithKyrian, Nyholm and chr-hertel as code owners January 12, 2026 11:43

sveneld mentioned this pull request Jan 12, 2026

Add Middleware handlers to StreamableHttpTransport #218

Merged

9 tasks

chr-hertel changed the title ~~Oauth2 based on middleware~~ [Server] Oauth2 based on middleware Jan 23, 2026

chr-hertel added Server Issues & PRs related to the Server component auth Issues and PRs related to Authentication / OAuth labels Jan 23, 2026

chr-hertel requested changes Jan 26, 2026

View reviewed changes

OAuth Implementation based on middleware

79a9916

chr-hertel mentioned this pull request Feb 8, 2026

OAuth 2.0 authorization flow #194

Closed

6 tasks

Volodymyr Panivko and others added 2 commits February 11, 2026 20:54

Add Middleware handlers to StreamableHttpTransport

446569a

OAuth Implementation based on middleware

81c94bc

sveneld force-pushed the oauth_middleware branch from 84ad698 to 9d801c9 Compare February 11, 2026 19:55

OAuth Implementation based on middleware

eb2a422

Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com>

sveneld force-pushed the oauth_middleware branch from 9d801c9 to eb2a422 Compare February 11, 2026 19:56

Nyholm reviewed Feb 11, 2026

View reviewed changes

sveneld added 2 commits February 15, 2026 20:22

Address PR review feedback for OAuth middleware

c61a756

Apply php-cs-fixer to satisfy QA

0add43d

sveneld added 2 commits February 21, 2026 18:33

Use Mcp exception classes in OAuth middleware

a2dcce7

Refactor OAuth HTTP stack and add Microsoft example policies

ba5ef52

sveneld added 2 commits February 22, 2026 11:32

Fix QA PHPStan findings in OAuth examples and auth middleware

d7650fb

Require OIDC discovery in JWKS provider and refine OAuth proxy behavior

74b1654

sveneld added 2 commits February 22, 2026 12:46

Remove local development docker artifacts from VCS

cbdb546

Revert .gitignore changes for local docker files

fca16ad

This was referenced Feb 22, 2026

[Server] Implement OAuth Flow for Client Authentication #214

Closed

PHP SDK — Tier 3 Assessment modelcontextprotocol/modelcontextprotocol#2305

Closed

Fix body retrieval in OAuthRequestMetaMiddleware for proper string co…

1096f8e

…nversion Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com>

took mentioned this pull request Feb 28, 2026

MCP for LLMs to use yiisoft/yii-gii#150

Open

chr-hertel requested changes Mar 1, 2026

View reviewed changes

chr-hertel added the needs more work Not ready to be merged yet, needs additional follow-up from the author(s). label Mar 1, 2026

Volodymyr Panivko and others added 4 commits March 2, 2026 10:00

Address OAuth PR review feedback and align example configs

2943a06

Fix QA style issues and add authorization docs

4f555f0

Fix PHPStan typing issues in OAuth middleware

637289f

Remove duplicate Middleware namespace, consolidate under Http\Middleware

4f09780

Remove old Mcp\Server\Transport\Middleware\ classes that were duplicated in Mcp\Server\Transport\Http\Middleware\ and Http\OAuth\. Update docs to reference the correct namespaces.

chr-hertel reviewed Mar 9, 2026

View reviewed changes

Comment thread src/Server/Transport/Http/Middleware/OAuthProxyMiddleware.php Outdated

chr-hertel reviewed Mar 9, 2026

View reviewed changes

Comment thread src/Server/Transport/Http/OAuth/JwtTokenValidator.php Outdated

chr-hertel added this to the 0.5.0 milestone Mar 9, 2026

chr-hertel approved these changes Mar 10, 2026

View reviewed changes

chr-hertel merged commit e3f4b88 into modelcontextprotocol:main Mar 10, 2026
17 checks passed

chr-hertel mentioned this pull request Mar 10, 2026

Add changelog entries for client and server auth #257

Merged

soyuka mentioned this pull request Jun 15, 2026

[Server] scope OAuth to resource server, not authorization server #382

Merged

chr-hertel mentioned this pull request Aug 19, 2026

[Server][Auth] SEP-2350: Emit per-operation scopes in insufficient_scope 403 responses (RFC 6750 §3.1) #362

Closed

Uh oh!

Conversation

sveneld commented Jan 12, 2026 • edited by chr-hertel Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

Checklist

Additional context

Uh oh!

chr-hertel commented Jan 18, 2026

Uh oh!

chr-hertel left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sveneld commented Jan 28, 2026

Uh oh!

Nyholm commented Feb 11, 2026

Uh oh!

sveneld commented Feb 11, 2026

Uh oh!

Nyholm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sveneld commented Feb 16, 2026

Uh oh!

chr-hertel commented Feb 17, 2026

Uh oh!

sveneld commented Feb 18, 2026

Uh oh!

sveneld commented Feb 22, 2026

Uh oh!

chr-hertel commented Feb 26, 2026

Uh oh!

chr-hertel left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sveneld commented Mar 2, 2026

Uh oh!

sveneld commented Mar 9, 2026

Uh oh!

chr-hertel commented Mar 9, 2026

Uh oh!

sveneld commented Mar 9, 2026

Uh oh!

Uh oh!

Uh oh!

chr-hertel left a comment

Choose a reason for hiding this comment

sveneld commented Jan 12, 2026 •

edited by chr-hertel

Loading