fix(oauth): omit resource on refresh token

Author: Epochex

src/mcp/client/auth/oauth2.py

@@ -151,7 +151,10 @@ def get_resource_url(self) -> str:
 
         # If PRM provides a resource that's a valid parent, use it
         if self.protected_resource_metadata and self.protected_resource_metadata.resource:
-            prm_resource = str(self.protected_resource_metadata.resource)
+            # Pydantic v2 AnyHttpUrl normalizes bare-domain URLs by appending a trailing
+            # slash (e.g. "https://example.com" -> "https://example.com/"). OAuth
+            # providers may treat that as a distinct audience, so strip it.
+            prm_resource = str(self.protected_resource_metadata.resource).rstrip("/")
             if check_resource_allowed(requested_resource=resource, configured_resource=prm_resource):
                 resource = prm_resource
 
@@ -442,10 +445,6 @@ async def _refresh_token(self) -> httpx.Request:
             "client_id": self.context.client_info.client_id,
         }
 
-        # Only include resource param if conditions are met
-        if self.context.should_include_resource_param(self.context.protocol_version):
-            refresh_data["resource"] = self.context.get_resource_url()  # RFC 8707
-
         # Prepare authentication based on preferred method
         headers = {"Content-Type": "application/x-www-form-urlencoded"}
         refresh_data, headers = self.context.prepare_token_auth(refresh_data, headers)

tests/client/test_auth.py

@@ -259,6 +259,24 @@ def test_clear_tokens(self, oauth_provider: OAuthClientProvider, valid_tokens: O
         assert context.current_tokens is None
         assert context.token_expiry_time is None
 
+    def test_get_resource_url_strips_trailing_slash_from_bare_domain_prm(
+        self, client_metadata: OAuthClientMetadata, mock_storage: MockTokenStorage
+    ) -> None:
+        """get_resource_url strips Pydantic AnyHttpUrl trailing slash for bare-domain PRM."""
+        provider = OAuthClientProvider(
+            server_url="https://api.example.com/v1/mcp",
+            client_metadata=client_metadata,
+            storage=mock_storage,
+        )
+        provider._initialized = True
+
+        provider.context.protected_resource_metadata = ProtectedResourceMetadata(
+            resource=AnyHttpUrl("https://api.example.com"),
+            authorization_servers=[AnyHttpUrl("https://auth.example.com")],
+        )
+
+        assert provider.context.get_resource_url() == snapshot("https://api.example.com")
+
 
 class TestOAuthFlow:
     """Test OAuth flow methods."""
@@ -631,6 +649,35 @@ async def test_refresh_token_request(self, oauth_provider: OAuthClientProvider,
         assert "client_id=test_client" in content
         assert "client_secret=test_secret" in content
 
+    @pytest.mark.anyio
+    async def test_refresh_token_request_omits_resource_even_when_required_by_protocol(
+        self, client_metadata: OAuthClientMetadata, mock_storage: MockTokenStorage
+    ) -> None:
+        """refresh_token request should not include RFC8707 resource parameter."""
+        provider = OAuthClientProvider(
+            server_url="https://api.example.com/v1/mcp",
+            client_metadata=client_metadata,
+            storage=mock_storage,
+        )
+        provider._initialized = True
+        provider.context.protocol_version = "2025-06-18"
+        provider.context.current_tokens = OAuthToken(
+            access_token="test_access_token",
+            token_type="bearer",
+            expires_in=3600,
+            refresh_token="test_refresh_token",
+        )
+        provider.context.client_info = OAuthClientInformationFull(
+            client_id="test_client",
+            client_secret="test_secret",
+            redirect_uris=[AnyUrl("http://localhost:3030/callback")],
+            token_endpoint_auth_method="client_secret_post",
+        )
+
+        request = await provider._refresh_token()
+        content = request.content.decode()
+        assert "resource=" not in content
+
     @pytest.mark.anyio
     async def test_basic_auth_token_exchange(self, oauth_provider: OAuthClientProvider):
         """Test token exchange with client_secret_basic authentication."""