OAuth2
We’ve definitely improved our security posture by moving from basic authentication to JWT. However, there’s still room for improvement. OAuth2 is a widely adopted authorization framework that provides a more robust and flexible way to secure your application.
It allows you to delegate access to your resources without sharing credentials. What that means concretely is that there are three parties involved when accessing a resource:
- Resource server: This is the server that hosts the protected resources, in our case, the MCP server
- Client: This is the application that wants to access the protected resources, in our case, the MCP client
- Authorization server: This is the server that issues access tokens to the client after successfully authenticating the resource owner and obtaining authorization
What about the delegation part? Well, the resource owner (typically the user) can delegate access to the client by granting it an access...
