Name redirect locations without query or userinfo everywhere; refuse-message covers any http downgrade

- The OAuth registration/token/refresh messages named an unfollowed redirect
  with the raw location; they now share one helper with the transport message
  and print it without userinfo, query or fragment.
- The "would downgrade to plain HTTP" explanation applies to any http location
  an https endpoint redirects to, not only one on the same host, so the error
  never suggests configuring an http:// URL.
- Docstrings and the migration note say which redirects are followed more
  precisely (307/308 for a POST, any status for a GET).

Author: maxisbey

docs/migration.md

@@ -2102,7 +2102,7 @@ async with http_client:
         ...
 ```
 
-v1's internal client set `follow_redirects=True`. You don't need it on your own client: the transport follows a redirect within the endpoint's origin (a trailing-slash redirect, say) itself, and does not follow one anywhere else, whatever the client is configured to do.
+v1's internal client set `follow_redirects=True`. You don't need it on your own client: the transport follows a method-preserving redirect within the endpoint's origin (a trailing-slash 307/308, say) itself, and does not follow one anywhere else, whatever the client is configured to do.
 
 `streamable_http_client` itself keeps a small signature — `streamable_http_client(url, *, http_client=None, terminate_on_close=True)` — and now yields a 2-tuple (next section). The removed function's other parameters map onto the client you build:
 

src/mcp/client/sse.py

@@ -55,7 +55,8 @@ async def sse_client(
         httpx_client_factory: Factory function for creating the httpx2 client. Whichever client it
             returns, MCP requests follow a redirect only when it stays on the endpoint's origin
             (same scheme, host and port, or http to https on the same host with default ports) and
-            keeps the request method; any other redirect is not followed, so connecting fails with
+            keeps the request method (any status for the SSE GET, 307/308 for a message POST); any
+            other redirect is not followed, so connecting fails with
             `httpx2.HTTPStatusError` for the redirect response. The client's `follow_redirects`
             setting is not consulted; the SDK's OAuth providers apply the same rule to the requests
             they make.

src/mcp/client/streamable_http.py

@@ -35,6 +35,7 @@
 from mcp.shared._context_streams import ContextReceiveStream, ContextSendStream, create_context_streams
 from mcp.shared._httpx_utils import (
     create_mcp_http_client,
+    redirect_location,
     request_within_origin,
     sse_within_origin,
     stream_within_origin,
@@ -69,12 +70,10 @@ class ResumptionError(StreamableHTTPError):
 
 def _unfollowed_redirect(response: httpx2.Response) -> str | None:
     """Describe a redirect `stream_within_origin` left unfollowed, or None if `response` is not one."""
-    if response.next_request is None:
+    location = redirect_location(response)
+    if location is None:
         return None
-    sent = response.request.url
-    # Query and userinfo are left out: they can carry state that does not belong in logs.
-    location = response.next_request.url.copy_with(userinfo=b"", query=None, fragment=None)
-    if sent.scheme == "https" and location.scheme == "http" and location.host == sent.host:
+    if response.request.url.scheme == "https" and location.scheme == "http":
         return (
             f"Redirect to {location} not followed: it would downgrade this HTTPS endpoint to plain HTTP.\n"
             "The server is likely behind a TLS-terminating proxy whose forwarded headers it does not trust,\n"
@@ -694,8 +693,9 @@ async def streamable_http_client(
             authentication, or other HTTP settings, create an httpx2.AsyncClient and pass it here.
             Whichever client is used, MCP requests follow a redirect only when it stays on the
             endpoint's origin (same scheme, host and port, or http to https on the same host with
-            default ports) and keeps the request method (307/308); any other redirect is not
-            followed and the message it answered fails with an error naming the location. The
+            default ports) and keeps the request method (307/308 for a POST; any status for the GET
+            stream); any other redirect is not followed and the message it answered fails with an
+            error naming the location. The
             client's `follow_redirects` setting is not consulted; the SDK's OAuth providers apply the
             same rule to the requests they make.
         terminate_on_close: If True, send a DELETE request to terminate the session when the context exits.

src/mcp/shared/_httpx_utils.py

@@ -163,11 +163,20 @@ async def sse_within_origin(
         yield httpx2.EventSource(response)
 
 
+def redirect_location(response: httpx2.Response) -> httpx2.URL | None:
+    """Where `response` redirects to, for use in a message: without userinfo, query or fragment,
+    which can carry state that does not belong in an error or a log line. None if not a redirect."""
+    if response.next_request is None:
+        return None
+    return response.next_request.url.copy_with(userinfo=b"", query=None, fragment=None)
+
+
 def redirect_note(response: httpx2.Response) -> str:
     """A suffix naming the location of a redirect response that was not followed, else empty."""
-    if response.next_request is None:
+    location = redirect_location(response)
+    if location is None:
         return ""
-    return f" (redirected to {response.next_request.url}; not followed)"
+    return f" (redirected to {location}; not followed)"
 
 
 class RedirectAwareAuth(ABC, httpx2.Auth):

tests/client/test_auth.py

@@ -1082,11 +1082,11 @@ async def test_handle_registration_response_reads_before_accessing_text(self):
     @pytest.mark.anyio
     async def test_registration_error_names_an_unfollowed_redirect(self):
         """SDK-defined: when the registration endpoint answered with a redirect that was not followed,
-        the error says where it pointed instead of only the bare status."""
+        the error says where it pointed (without userinfo or query) instead of only the bare status."""
         request = httpx2.Request("POST", "https://as.example/register")
         async with httpx2.AsyncClient(
             transport=httpx2.MockTransport(
-                lambda r: httpx2.Response(307, headers={"location": "https://elsewhere.example/register"})
+                lambda r: httpx2.Response(307, headers={"location": "https://u:p@elsewhere.example/register?state=x"})
             )
         ) as client:
             response = await client.send(request)

tests/client/test_streamable_http.py

@@ -956,3 +956,15 @@ async def test_unfollowed_redirect_location_is_named_without_its_query_string()
     assert message == snapshot(
         "Redirect to https://sso.example/login not followed; use that URL as the endpoint if it is the intended server"
     )
+
+
+@pytest.mark.anyio
+async def test_https_endpoint_redirected_to_plain_http_elsewhere_never_suggests_the_http_url() -> None:
+    """SDK-authored text: the downgrade explanation applies whatever host the http:// location names,
+    so the message never offers a plain-HTTP URL as the endpoint to configure."""
+    message = await _redirected_call_error("https://mcp.example/mcp", "http://backend.lan:8000/mcp/")
+    assert message == snapshot("""\
+Redirect to http://backend.lan:8000/mcp/ not followed: it would downgrade this HTTPS endpoint to plain HTTP.
+The server is likely behind a TLS-terminating proxy whose forwarded headers it does not trust,
+often combined with a trailing-slash difference. Try https://backend.lan:8000/mcp/ instead, or fix the proxy settings.\
+""")