Class OAuthIdentifierUri

Namespace

MailFathom.Common.OAuth

Assembly

MailFathom.Common.dll

The shape OAuth requires of a URL used as a name rather than as something to fetch.

public static class OAuthIdentifierUri

Inheritance

object

OAuthIdentifierUri

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Two settings on the MCP endpoint carry such a URL, and both specifications constrain the shape identically. An authorization server's issuer identifier is an https URL with no query and no fragment (RFC 8414 section 2), and the canonical resource identifier a token's audience is bound to is an absolute URI without a fragment (RFC 8707 section 2, which the MCP authorization specification adopts). The shape is therefore one check used by both.

What the two do not share is whether the value may be rewritten, which is why IsWellFormed(string?) and TryCanonicalize(string?, out string) are separate. Both values end up in an exact string comparison — an issuer against a token's iss, a resource against its aud — and the difference is who writes the other side.

The resource is named by MailFathom itself: it is published in the protected resource metadata document, a client copies it into the resource parameter, and the authorization server puts it back in the token. Every appearance originates here, so bringing it to one canonical form makes two spellings of it impossible.

An issuer is the opposite. The authorization server emits iss in a form it chose, MailFathom only recognizes it, and several widely deployed servers publish an issuer whose path is a single trailing slash. Canonicalizing that away would leave a configuration that looks right and refuses every token the server issues, so an issuer is validated for shape and then compared exactly as the operator copied it from the server.

A query component is refused in both cases even though RFC 8707 merely discourages it. An identifier carrying one is either a mistake or an attempt to build two identifiers a careless comparison would read as one, and neither is worth accepting for a value an operator writes once.

Methods

Canonicalize(string?)

Brings a configured identifier that has already been validated to its canonical form.

IsWellFormed(string?)

Reports whether a configured value has the shape OAuth requires of an identifier.

TryCanonicalize(string?, out string)

Brings a configured identifier to the one form everything else compares against.