Repository: jlowin/fastmcp
File: src/fastmcp/server/auth/oauth_proxy/models.py (Python)

Code before:
    Without proper validation, clients could get "Redirect URI not registered" errors
    when trying to authenticate with cached tokens, or security vulnerabilities could
    arise from accepting arbitrary redirect URIs.
    """

    allowed_redirect_uri_patterns: list[str] | None = Field(default=None)
    client_name: str | None = Field(default=None)

    def validate_redirect_uri(self, redirect_uri: AnyUrl | None) -> AnyUrl:
        """Validate redirect URI against allowed patterns.

        Since we're acting as a proxy and clients register dynamically,
        we validate their redirect URIs against configurable patterns.
        This is essential for cached token scenarios where the client may
        reconnect with a different port.
        """
        if redirect_uri is not None:
            # Validate against allowed patterns
            if validate_redirect_uri(
                redirect_uri=redirect_uri,
                allowed_patterns=self.allowed_redirect_uri_patterns,
            ):
                return redirect_uri

            # If patterns are explicitly configured (not None), reject non-matching URIs
            if self.allowed_redirect_uri_patterns is not None and any(
                self.allowed_redirect_uri_patterns
            ):
                raise InvalidRedirectUriError(
                    f"Redirect URI '{redirect_uri}' does not match allowed patterns: "
                    f"{self.allowed_redirect_uri_patterns}"
                )

        # If no redirect_uri provided, use default behavior
        return super().validate_redirect_uri(redirect_uri)


Review comment (suggestion):
I think this could be simplified to `if self.allowed_redirect_uri_patterns:`

As written, for example, [""] would not trip the condition since any(['']) is False. 

Code after:
    Without proper validation, clients could get "Redirect URI not registered" errors
    when trying to authenticate with cached tokens, or security vulnerabilities could
    arise from accepting arbitrary redirect URIs.
    """

    allowed_redirect_uri_patterns: list[str] | None = Field(default=None)
    client_name: str | None = Field(default=None)

    def validate_redirect_uri(self, redirect_uri: AnyUrl | None) -> AnyUrl:
        """Validate redirect URI against allowed patterns.

        Since we're acting as a proxy and clients register dynamically,
        we validate their redirect URIs against configurable patterns.
        This is essential for cached token scenarios where the client may
        reconnect with a different port.
        """
        if redirect_uri is not None:
            # Validate against allowed patterns
            if validate_redirect_uri(
                redirect_uri=redirect_uri,
                allowed_patterns=self.allowed_redirect_uri_patterns,
            ):
                return redirect_uri

            # If patterns are explicitly configured then reject non-matching URIs
            if self.allowed_redirect_uri_patterns:
                raise InvalidRedirectUriError(
                    f"Redirect URI '{redirect_uri}' does not match allowed patterns."
                )

        # If no redirect_uri provided, use default behavior
        return super().validate_redirect_uri(redirect_uri)