Skip to content

OIDC discovery is fetched repeatedly for identical configuration #4837

Description

@sui-ni2

What happened?

Every call to OIDCConfiguration.get_oidc_configuration() hits the discovery URL again, even when the URL and options are unchanged. This has caused Auth0 throttling for a user in #4054.

I expected the second call to reuse the first successful result. It currently makes another request.

Example Code

from unittest.mock import MagicMock, patch

from httpx2 import Response
from pydantic import AnyHttpUrl

from fastmcp.server.auth.oidc_proxy import OIDCConfiguration

url = AnyHttpUrl("https://example.com/.well-known/openid-configuration")
document = {
    "issuer": "https://example.com",
    "authorization_endpoint": "https://example.com/authorize",
    "token_endpoint": "https://example.com/token",
    "jwks_uri": "https://example.com/jwks",
    "response_types_supported": ["code"],
    "subject_types_supported": ["public"],
    "id_token_signing_alg_values_supported": ["RS256"],
}

with patch("httpx2.get") as get:
    response = MagicMock(spec=Response)
    response.json.return_value = document
    get.return_value = response

    for _ in range(2):
        OIDCConfiguration.get_oidc_configuration(
            config_url=url,
            strict=True,
            timeout_seconds=10,
        )

    print(get.call_count)  # 2

Version Information

FastMCP main at ba283ddb4c46789493e6fed5e2adc59c1ea76255; Python 3.12.10; Windows.

Metadata

Metadata

Assignees

Labels

authRelated to authentication (Bearer, JWT, OAuth, WorkOS) for client or server.bugSomething isn't working. Reports of errors, unexpected behavior, or broken functionality.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions