{"record":{"id":"6229f52294ddbe33","repo":"siyuan-note/siyuan","slug":"parse-oauth-challenge-w","errorCode":null,"errorMessage":"parse OAuth challenge: %w","messagePattern":"parse OAuth challenge: %w","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/mcp/client/oauth.go","lineNumber":189,"sourceCode":"\treturn credentialToken(refreshed), nil\n}\n\nfunc credentialToken(credential oauthCredential) *oauth2.Token {\n\treturn &oauth2.Token{\n\t\tAccessToken:  credential.AccessToken,\n\t\tTokenType:    credential.TokenType,\n\t\tRefreshToken: credential.RefreshToken,\n\t\tExpiry:       credential.Expiry,\n\t}\n}\n\nfunc (h *mcpOAuthHandler) Authorize(ctx context.Context, req *http.Request, resp *http.Response) (retErr error) {\n\tdefer resp.Body.Close()\n\tdefer io.Copy(io.Discard, io.LimitReader(resp.Body, 1<<20))\n\n\tchallenges, err := oauthex.ParseWWWAuthenticate(resp.Header.Values(\"WWW-Authenticate\"))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parse OAuth challenge: %w\", err)\n\t}\n\tif !hasBearerChallenge(challenges) {\n\t\treturn fmt.Errorf(\"server returned %s without an OAuth Bearer challenge\", resp.Status)\n\t}\n\tchallengeError := bearerChallengeParam(challenges, \"error\")\n\tif resp.StatusCode == http.StatusForbidden && challengeError != \"insufficient_scope\" {\n\t\treturn fmt.Errorf(\"server returned %s\", resp.Status)\n\t}\n\tinteractive := h.interactive.Load()\n\tif interactive {\n\t\tdefer func() {\n\t\t\tif retErr != nil && !errors.Is(retErr, context.Canceled) {\n\t\t\t\tsetMCPRuntimeStateForContext(ctx, h.server.ID, \"authorization_required\", 0, retErr.Error(), \"\")\n\t\t\t}\n\t\t}()\n\t}\n\n\tprm, err := discoverProtectedResource(ctx, challenges, req.URL.String(), h.client)","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/mcp/client/oauth.go#L171-L207","documentation":"Returned by mcpOAuthHandler.Authorize when oauthex.ParseWWWAuthenticate cannot parse the WWW-Authenticate header(s) on a 401 response. The wrapped parse error explains the syntactic problem. Without a parseable challenge list, the OAuth flow cannot discover the authorization server.","triggerScenarios":"The MCP HTTP server returns 401 with one or more WWW-Authenticate header values that are not valid RFC 6750/7235 challenge strings (malformed auth-scheme, unquoted parameters, stray tokens). ParseWWWAuthenticate returns an error and Authorize wraps it.","commonSituations":"Server sends a custom auth scheme instead of Bearer; header is a free-form string like 'Please log in'; proxy injected a malformed challenge; server-side bug producing unquoted parameters; multiple WWW-Authenticate headers with conflicting schemes.","solutions":["curl -i the endpoint and inspect the raw WWW-Authenticate header; confirm it is a syntactically valid Bearer challenge.","If the server uses a non-Bearer scheme, OAuth cannot be used — set server.Headers with a static Authorization (or other) header instead, which disables the OAuth path via hasAuthorizationHeader.","Report the malformed header to the MCP server operator if the server is supposed to be OAuth-compliant.","If a proxy rewrites the header, bypass or reconfigure the proxy for this endpoint."],"exampleFix":"# expected (well-formed)\nWWW-Authenticate: Bearer realm=\"api\", error=\"invalid_token\"\n# malformed example that triggers the error\nWWW-Authenticate: Please authenticate","handlingStrategy":"validation","validationCode":"// Verify the WWW-Authenticate header shape before relying on OAuth.\nimport \"github.com/modelcontextprotocol/go-sdk/oauthex\"\nfunc probeChallenge(url string) error {\n    // fetch the endpoint, get a 401, then:\n    // _, err := oauthex.ParseWWWAuthenticate(resp.Header.Values(\"WWW-Authenticate\"))\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["curl -i the endpoint to inspect WWW-Authenticate before configuring OAuth.","If the header is non-standard, switch to static Authorization headers."],"tags":["mcp","oauth","http-headers","auth"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}