[MCP Authentication] Add Sub Path Protected Resource Metadata (PRM) Support (#28)
Temporarily Patch MCP .NET SDK’s `McpAuthenticationHandler`
([source](https://github.com/modelcontextprotocol/csharp-sdk/blob/ab6d3e1ac51c129d311d19afe2925e434372bbd8/src/ModelContextProtocol.AspNetCore/Authentication/McpAuthenticationHandler.cs#L57))
where the Protected Resource Metadata (PRM) URL does not include the
requested resource’s subpath.
When constructing the PRM URL, append the original request path after
the well-known suffix.
In the PRM response, set resource to the exact original resource URL
with sub path
Expected in [RFC 9728
§3.1](https://datatracker.ietf.org/doc/html/rfc9728/#section-3.1) The
PRM URL must be built by **inserting the well-known suffix between the
host and the resource’s existing path.
For a resource hosted on a subpath:
Input (client request):
```
https://exmaple.com/test/mcp
```
Expected PRM URL:
```
https://exmaple.com/.well-known/oauth-protected-resource/test/mcp
```
And in the PRM response, the `resource` value should echo the original
resource URL:
```json
{
"resource": "https://exmaple.com/test/mcp",
...
}
``` L
Lili Xu committed
7f5dc19f5201312197e3893fc25b0422e6f8c5e0
Parent: 949db22
Committed by GitHub <noreply@github.com>
on 9/23/2025, 3:17:39 AM