Handle more Bearer auth-param edge cases

Author: Whning0513

src/mcp/client/auth/utils.py

@@ -48,12 +48,14 @@ def _extract_bearer_auth_params(www_auth_header: str) -> str | None:
     for segment in segments:
         scheme, separator, remainder = segment.partition(" ")
         if scheme.lower() == "bearer" and separator:
+            if collecting:
+                break
             collecting = True
             auth_params = [remainder.strip()]
             continue
 
         if collecting:
-            if separator and "=" not in scheme:
+            if separator and "=" not in scheme and not remainder.lstrip().startswith("="):
                 break
             auth_params.append(segment)
 
@@ -77,7 +79,9 @@ def extract_field_from_www_auth(response: Response, field_name: str) -> str | No
         return None
 
     # Match comma-delimited auth-params while respecting quoted values.
-    pattern = re.compile(r'(?:^|,\s*)(?P<name>[A-Za-z][A-Za-z0-9_-]*)=(?:"(?P<quoted>[^"]+)"|(?P<unquoted>[^,\s]+))')
+    pattern = re.compile(
+        r'(?:^|,\s*)(?P<name>[A-Za-z][A-Za-z0-9_-]*)\s*=\s*(?:"(?P<quoted>[^"]*)"|(?P<unquoted>[^,\s]+))'
+    )
     for match in pattern.finditer(auth_params):
         if match.group("name") == field_name:
             # Return quoted value if present, otherwise unquoted value

tests/client/test_auth.py

@@ -181,6 +181,39 @@ def test_pkce_uniqueness(self):
         assert pkce1.code_challenge != pkce2.code_challenge
 
 
+class TestExtractFieldFromWwwAuth:
+    def test_uses_first_bearer_challenge_when_multiple_are_present(self):
+        response = httpx.Response(
+            401,
+            headers={
+                "WWW-Authenticate": (
+                    'Basic realm="legacy", Bearer scope="read", error="insufficient_scope", Bearer scope="write"'
+                )
+            },
+            request=httpx.Request("GET", "https://example.com"),
+        )
+
+        assert extract_scope_from_www_auth(response) == "read"
+
+    def test_supports_optional_whitespace_around_equals(self):
+        response = httpx.Response(
+            401,
+            headers={
+                "WWW-Authenticate": (
+                    'Bearer error="insufficient_scope", scope = "read write", '
+                    'resource_metadata = "https://example.com/.well-known/oauth-protected-resource"'
+                )
+            },
+            request=httpx.Request("GET", "https://example.com"),
+        )
+
+        assert extract_scope_from_www_auth(response) == "read write"
+        assert (
+            extract_resource_metadata_from_www_auth(response)
+            == "https://example.com/.well-known/oauth-protected-resource"
+        )
+
+
 class TestOAuthContext:
     """Test OAuth context functionality."""