Function GetEffectiveHostAndScheme

pkg/http/oauth/oauth.go:218–246

GetEffectiveHostAndScheme returns the effective host and scheme for a request. X-Forwarded-Host and X-Forwarded-Proto are only honored when cfg.TrustProxyHeaders is true. Without that opt-in, an untrusted client could otherwise influence the OAuth resource metadata URL advertised to MCP clients.

(r *http.Request, cfg *Config)

// is true. Without that opt-in, an untrusted client could otherwise influence the
// OAuth resource metadata URL advertised to MCP clients.
func GetEffectiveHostAndScheme(r *http.Request, cfg *Config) (host, scheme string) { //nolint:revive
	trustProxy := cfg != nil && cfg.TrustProxyHeaders

	if trustProxy {
		if fh := r.Header.Get(headers.ForwardedHostHeader); fh != "" {
			host = fh
		}
	}
	if host == "" {
		host = r.Host
	}
	if host == "" {
		host = "localhost"
	}

	if trustProxy {
		if fp := r.Header.Get(headers.ForwardedProtoHeader); fp != "" {
			scheme = strings.ToLower(fp)
		}
	}
	if scheme == "" {
		if r.TLS != nil {
			scheme = "https"
		} else {
			scheme = "http"
		}
	}
	return
}

// BuildResourceMetadataURL constructs the full URL to the OAuth protected resource metadata endpoint.
func BuildResourceMetadataURL(r *http.Request, cfg *Config, resourcePath string) string {