MikolajBalcerek opened a new issue, #45390:
URL: https://github.com/apache/superset/issues/45390
### Bug description
# Bug description
The MCP browser hello page added in #40471 is served for **any**
`GET`/`HEAD` request with an
`Accept: text/html` header, regardless of path.
When I set on 7.0 rc1 `MCP_AUTH_FACTORY` to return an OAuth-proxy provider
(fastmcp's `GoogleProvider` `), the provider's browser-facing routes are
swallowed by the hello page.
So the login doesn't work to MCP.
It needs to allow through other than `/mcp` paths:
- GET /authorize
- GET /.well-known/oauth-authorization-server
# Reproduction
1. Superset 7.0.0rc1 release, MCP service enabled.
2. Configure an OAuth-proxy auth provider:
```python
def MCP_AUTH_FACTORY(app):
from fastmcp.server.auth.providers.google import GoogleProvider
return GoogleProvider(client_id=..., client_secret=...,
base_url="http://localhost:5008";,
required_scopes=["openid", "email"])
```
3. Request the authorization endpoint the way a browser does:
```bash
curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" -H 'Accept:
text/html,application/xhtml+xml' \
'http://localhost:5008/authorize?response_type=code&client_id=...&redirect_uri=...&code_challenge=...&code_challenge_method=S256'
```
or add the server to an MCP client and authenticate.
### Expected results
`302` to the provider's consent/login page (`/consent?txn_id=...`), as
returned for the same request
without a browser `Accept` header.
### Actual results
`200` with the "Superset MCP Server" hello page. The browser shows the hello
page instead continuing logging in flow
### Root cause
`superset/mcp_service/jwt_verifier.py`: `BrowserHelloMiddleware.dispatch` /
`_prefers_browser_html` only
check the method and `Accept` header, not the path, and the middleware is
mounted for the whole app in
`server.py::_build_starlette_middleware`.
### Suggested fix
Serve the hello page only for the MCP endpoint path
(`fastmcp.settings.streamable_http_path`, `/mcp` by
default) and let every other route pass through.
### Environment
- Superset `7.0.0rc1` (`apache/superset:7.0.0rc1` image); code unchanged on
`master` as of 2026-10-16
- fastmcp 3.4.8, mcp 1.30.0
- MCP client: Claude Code (OAuth with CIMD client metadata)
### Screenshots/recordings
_No response_
### Superset version
master / latest-dev
### Python version
3.11
### Node version
16
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [ ] I have searched Superset docs and Slack and didn't find a solution to
my problem.
- [ ] I have searched the GitHub issue tracker and didn't find a similar bug
report.
- [ ] I have checked Superset's logs for errors and if I found a relevant
Python stacktrace, I included it here as text in the "additional context"
section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
