unauthorized writes a 401 with an RFC 9728 / MCP-authorization-spec WWW-Authenticate header so compliant MCP clients can auto-discover the authorization server. The header references the host-global protected resource metadata endpoint (served by the oauth2 package).
(c *echo.Context, errDescription string)
| 183 | // authorization server. The header references the host-global protected |
| 184 | // resource metadata endpoint (served by the oauth2 package). |
| 185 | func (s *Server) unauthorized(c *echo.Context, errDescription string) error { |
| 186 | resourceMetadataURL := s.buildResourceMetadataURL(c) |
| 187 | c.Response().Header().Set( |
| 188 | "WWW-Authenticate", |
| 189 | fmt.Sprintf( |
| 190 | `Bearer realm="OAuth", resource_metadata=%q, error="invalid_token", error_description=%q`, |
| 191 | resourceMetadataURL, errDescription, |
| 192 | ), |
| 193 | ) |
| 194 | return echo.NewHTTPError(http.StatusUnauthorized, errDescription) |
| 195 | } |
| 196 | |
| 197 | // buildResourceMetadataURL returns the absolute URL of the protected resource |
| 198 | // metadata document for the /mcp endpoint. The `/mcp` path suffix matters: |
no test coverage detected