scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-30 01:52:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 70

fix(mcp): allow browser consent to continue to the provider

Browse source
This commit is contained in:
Joshua Valluru 2026-09-21 12:26:30 -07:00
parent cade3e312f
commit c3461d8e8b
3 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py
View file

@ -1014,7 +1014,7 @@ async def authorize_with_server(
existing_params: Final = dict(parse_qsl(parsed_auth_url.query))
existing_params.update(params)
final_url: Final = urlunparse(parsed_auth_url._replace(query=urlencode(existing_params)))
response: Final = RedirectResponse(final_url)
response: Final = RedirectResponse(final_url, status_code=303 if connection is not None else 307)
_set_oauth_state_cookie(response, request, relay_state, encoded_state)
if connection is not None and len(response.headers["set-cookie"]) > 4096:
return _oauth_error(400, "invalid_request", "Connection authorization metadata is too large")

2
litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py
View file

@ -1716,7 +1716,7 @@ async def authorize_connection(
**TOKEN_NO_CACHE_HEADERS,
"Referrer-Policy": "no-referrer",
"X-Frame-Options": "DENY",
"Content-Security-Policy": "default-src 'none'; form-action 'self'; frame-ancestors 'none'",
"Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
}
),
)

10
tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py
View file

@ -12474,7 +12474,7 @@ def _complete_keyed_oauth(harness):
client_id, verifier, handle = _start_keyed_oauth(harness)
consent = harness.client.post("/authorize/connection/complete", data={"flow": handle, "decision": "approve"})
assert consent.status_code == 307, consent.text
assert consent.status_code == 303, consent.text
upstream = urlparse(consent.headers["location"])
assert upstream.netloc == "provider.example"
params = parse_qs(upstream.query)
@ -12601,7 +12601,7 @@ def test_keyed_connection_cookie_sizes_are_browser_safe(keyed_oauth_client, stat
assert approved.json()["error"] == "invalid_request"
assert state_length == 1024
else:
assert approved.status_code == 307
assert approved.status_code == 303
assert all(len(value) <= 4096 for value in approved.headers.get_list("set-cookie"))
harness.upstream.post.assert_not_called()
@ -12893,7 +12893,7 @@ def test_keyed_connection_callback_cancellation_and_replay(keyed_oauth_client, c
harness = keyed_oauth_client
_, _, handle = _start_keyed_oauth(harness)
approved = harness.client.post("/authorize/connection/complete", data={"flow": handle, "decision": "approve"})
assert approved.status_code == 307
assert approved.status_code == 303
state = parse_qs(urlparse(approved.headers["location"]).query)["state"][0]
cookies = dict(harness.client.cookies.items())
response = harness.client.get(
@ -12919,7 +12919,7 @@ def test_keyed_connection_replayed_approved_consent_does_not_redirect_twice(keye
_, _, handle = _start_keyed_oauth(harness)
cookies = dict(harness.client.cookies.items())
approved = harness.client.post("/authorize/connection/complete", data={"flow": handle, "decision": "approve"})
assert approved.status_code == 307
assert approved.status_code == 303
harness.client.cookies.update(cookies)
repeated = harness.client.post("/authorize/connection/complete", data={"flow": handle, "decision": "approve"})
assert repeated.status_code == 400
@ -12935,7 +12935,7 @@ def test_keyed_connection_expired_callback_never_issues_code(keyed_oauth_client,
harness = keyed_oauth_client
_, _, handle = _start_keyed_oauth(harness)
approved = harness.client.post("/authorize/connection/complete", data={"flow": handle, "decision": "approve"})
assert approved.status_code == 307
assert approved.status_code == 303
state = parse_qs(urlparse(approved.headers["location"]).query)["state"][0]
clock = MagicMock()
clock.now.return_value = datetime.now(timezone.utc) + timedelta(days=1)