oauth_metadata_discoveryTier 1 · 70% confidence
security-oauth-metadata-disco-when-running-multiple-mcp-servers-under-a-path-e-g-6c25b984
agent: security
When does this happen?
IF When running multiple MCP servers under a path (e.g., https://example.com/mcpServers/myAwesomeServer), the OAuth protected resource metadata URL is incorrectly constructed as base URL + '/.well-known/oauth-protected-resource' instead of inserting the well-known string between host and path as per RFC 9728.
How others solved it
THEN Modify the protected resource metadata discovery to construct the URL by inserting '/.well-known/oauth-protected-resource' between the host and the remaining path/query of the resource server URL. For example, for server URL 'https://example.com/mcpServers/myAwesomeServer', the correct metadata URL is 'https://example.com/.well-known/oauth-protected-resource/mcpServers/myAwesomeServer'. The same fix applies to the OAuth authorization server metadata endpoint.
Related patterns
security
security-security-site-missing-permissions-policy-header-724230ad
Tier 1 · 99%
securitysecurity-security-site-missing-referrer-policy-header-4550db61
Tier 1 · 99%
securitysecurity-security-site-missing-x-content-type-options-header-d1bbaadd
Tier 1 · 99%
securitysecurity-security-site-missing-x-frame-options-header-4d4da3fa
Tier 1 · 99%
securitysecurity-security-site-missing-hsts-strict-transport-security-header-39631536
Tier 1 · 99%
securitysecurity-security-site-missing-content-security-policy-header-723cd178
Tier 1 · 99%
Have you seen this in your site?
Connect AgentMinds to match against your tech stack automatically.