fix(gateway): advertise the reachable host in OAuth/MCP metadata on a network bind

When bound to 0.0.0.0 the OAuth/MCP discovery metadata (RFC 8414 issuer +
endpoints, RFC 9728 resource / authorization_servers, and the 401
WWW-Authenticate resource_metadata URL) advertised http://localhost:<port> —
unresolvable for a remote LAN client, breaking the inbound OAuth flow.

Add effective_base_url(public_base_url, network_bind, host, fallback):
- a configured public base URL is pinned (tunnel/https), else
- on a network bind, derive from the request Host header (the LAN IP / hostname
  / mDNS name the client actually used), else
- fall back to the configured local base.

Gated on network_bind, so loopback advertising is byte-identical to before —
all 24 streamable_http integration tests (incl. the full OAuth e2e flow) pass
unchanged. GatewayState carries public_base_url + network_bind; the two metadata
handlers and the /mcp 401 path use the helper.

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

crates/mcpmux-gateway/src/mcp/oauth_middleware.rs

@@ -44,9 +44,21 @@ pub async fn mcp_oauth_middleware(
         .map(|ctx| ctx.trace_id.clone())
         .unwrap_or_else(|| "??????".to_string());
 
+    // Advertise the address the client actually reached us on (or the configured
+    // public base URL) so a gateway bound to 0.0.0.0 returns a resource-metadata
+    // URL the remote client can resolve — see `effective_base_url`.
     let base_url = {
         let state = services.gateway_state.read().await;
-        state.base_url.clone()
+        let host = request
+            .headers()
+            .get(header::HOST)
+            .and_then(|v| v.to_str().ok());
+        crate::server::effective_base_url(
+            state.public_base_url.as_deref(),
+            state.network_bind,
+            host,
+            &state.base_url,
+        )
     };
 
     // System-wide inbound auth can be disabled (localhost-only convenience):

crates/mcpmux-gateway/src/server/handlers.rs

@@ -66,19 +66,100 @@ pub struct OAuthServerMetadata {
     pub client_id_metadata_document_supported: Option<bool>,
 }
 
+/// The base URL to advertise in OAuth / MCP metadata.
+///
+/// Precedence:
+/// 1. An explicitly configured public base URL (e.g. an https tunnel origin) —
+///    pinned regardless of how the request arrived.
+/// 2. On a network bind (`0.0.0.0`), the host the client actually reached the
+///    gateway on (the request `Host` header), so the advertised endpoints are
+///    the LAN IP / hostname / mDNS name the client used, not `localhost`.
+/// 3. Otherwise the configured local fallback (`base_url`, http://localhost:port).
+pub(crate) fn effective_base_url(
+    public_base_url: Option<&str>,
+    network_bind: bool,
+    host_header: Option<&str>,
+    local_fallback: &str,
+) -> String {
+    if let Some(public) = public_base_url.map(str::trim).filter(|s| !s.is_empty()) {
+        return public.trim_end_matches('/').to_string();
+    }
+    if network_bind {
+        if let Some(host) = host_header.map(str::trim).filter(|s| !s.is_empty()) {
+            return format!("http://{}", host.trim_end_matches('/'));
+        }
+    }
+    local_fallback.trim_end_matches('/').to_string()
+}
+
+#[cfg(test)]
+mod base_url_tests {
+    use super::effective_base_url;
+
+    const LOCAL: &str = "http://localhost:45818";
+
+    #[test]
+    fn public_base_url_is_pinned_over_host() {
+        assert_eq!(
+            effective_base_url(
+                Some("https://mcp.example.com/"),
+                true,
+                Some("192.168.1.5:45818"),
+                LOCAL
+            ),
+            "https://mcp.example.com"
+        );
+    }
+
+    #[test]
+    fn network_bind_advertises_the_request_host() {
+        assert_eq!(
+            effective_base_url(None, true, Some("192.168.1.5:45818"), LOCAL),
+            "http://192.168.1.5:45818"
+        );
+    }
+
+    #[test]
+    fn network_bind_without_host_falls_back() {
+        assert_eq!(effective_base_url(None, true, None, LOCAL), LOCAL);
+    }
+
+    #[test]
+    fn loopback_bind_ignores_host_and_keeps_fallback() {
+        // Local-only behavior is unchanged even if a Host header is present.
+        assert_eq!(
+            effective_base_url(None, false, Some("evil.example"), LOCAL),
+            LOCAL
+        );
+    }
+}
+
 /// OAuth metadata endpoint (RFC 8414)
 pub async fn oauth_metadata(
     axum::extract::State(app_state): axum::extract::State<AppState>,
+    headers: axum::http::HeaderMap,
 ) -> Result<Json<OAuthServerMetadata>, StatusCode> {
     // When inbound auth is disabled, don't advertise an authorization server —
     // otherwise MCP clients that probe discovery start an OAuth flow even
     // though `/mcp` accepts them without a token. 404 makes them connect
     // tokenlessly.
-    if app_state.gateway_state.read().await.auth_disabled() {
-        return Err(StatusCode::NOT_FOUND);
-    }
+    let (public_base_url, network_bind) = {
+        let state = app_state.gateway_state.read().await;
+        if state.auth_disabled() {
+            return Err(StatusCode::NOT_FOUND);
+        }
+        (state.public_base_url.clone(), state.network_bind)
+    };
     info!("[Gateway] OAuth metadata request - serving authorization server metadata");
-    let base = &app_state.base_url;
+    let host = headers
+        .get(axum::http::header::HOST)
+        .and_then(|v| v.to_str().ok());
+    let base = effective_base_url(
+        public_base_url.as_deref(),
+        network_bind,
+        host,
+        &app_state.base_url,
+    );
     Ok(Json(OAuthServerMetadata {
         issuer: base.to_string(),
         authorization_endpoint: format!("{}/oauth/authorize", base),
@@ -111,14 +192,27 @@ pub struct ProtectedResourceMetadata {
 /// This tells MCP clients where to find the authorization server
 pub async fn resource_metadata(
     axum::extract::State(app_state): axum::extract::State<AppState>,
+    headers: axum::http::HeaderMap,
 ) -> Result<Json<ProtectedResourceMetadata>, StatusCode> {
     // See `oauth_metadata`: stay silent about auth when it's disabled so clients
     // don't kick off OAuth against a gateway that accepts them tokenlessly.
-    if app_state.gateway_state.read().await.auth_disabled() {
-        return Err(StatusCode::NOT_FOUND);
-    }
+    let (public_base_url, network_bind) = {
+        let state = app_state.gateway_state.read().await;
+        if state.auth_disabled() {
+            return Err(StatusCode::NOT_FOUND);
+        }
+        (state.public_base_url.clone(), state.network_bind)
+    };
     info!("[Gateway] Protected resource metadata request");
-    let base = &app_state.base_url;
+    let host = headers
+        .get(axum::http::header::HOST)
+        .and_then(|v| v.to_str().ok());
+    let base = effective_base_url(
+        public_base_url.as_deref(),
+        network_bind,
+        host,
+        &app_state.base_url,
+    );
     Ok(Json(ProtectedResourceMetadata {
         resource: format!("{}/mcp", base),
         authorization_servers: vec![base.to_string()],

crates/mcpmux-gateway/src/server/mod.rs

@@ -17,6 +17,7 @@ mod state;
 // inbound auth is disabled, and driving the full inbound OAuth flow
 // (register → authorize → consent → token → authenticated /mcp) end to end.
 // AppState is also used throughout this module.
+pub(crate) use handlers::effective_base_url;
 pub use handlers::{
     oauth_authorize, oauth_consent_approve, oauth_metadata, oauth_register, oauth_token,
     resource_metadata, AppState,
@@ -184,6 +185,8 @@ impl GatewayServer {
         // Configure gateway state
         let mut state = GatewayState::new(domain_event_tx.clone());
         state.set_base_url(config.base_url());
+        state.set_public_base_url(config.public_base_url.clone());
+        state.set_network_bind(config.is_network_bind());
         if let Some(jwt_secret) = dependencies.jwt_secret.clone() {
             state.set_jwt_secret(jwt_secret);
         }

crates/mcpmux-gateway/src/server/state.rs

@@ -43,6 +43,14 @@ pub struct ClientSession {
 pub struct GatewayState {
     /// Base URL for this gateway (e.g., "http://localhost:3100")
     pub base_url: String,
+    /// Configured public base URL (e.g. an https tunnel origin). When set it is
+    /// advertised verbatim in OAuth/MCP metadata; when None the advertised base
+    /// is the request Host (on a network bind) or `base_url` (loopback).
+    pub public_base_url: Option<String>,
+    /// True when the gateway is bound to a non-loopback address. Lets the
+    /// metadata handlers advertise the host a remote client actually used
+    /// instead of `localhost`, without changing local-only behavior.
+    pub network_bind: bool,
     /// Active client sessions
     pub sessions: HashMap<Uuid, ClientSession>,
     /// Access key to client ID mapping
@@ -73,6 +81,8 @@ impl GatewayState {
     pub fn new(domain_event_tx: broadcast::Sender<DomainEvent>) -> Self {
         Self {
             base_url: "http://localhost:3100".to_string(), // Default
+            public_base_url: None,
+            network_bind: false,
             sessions: HashMap::new(),
             access_keys: HashMap::new(),
             oauth_tokens: HashMap::new(),
@@ -92,6 +102,16 @@ impl GatewayState {
         self.base_url = base_url;
     }
 
+    /// Set the configured public base URL (None = local-only / host-derived).
+    pub fn set_public_base_url(&mut self, public_base_url: Option<String>) {
+        self.public_base_url = public_base_url;
+    }
+
+    /// Record whether the gateway is bound to a non-loopback address.
+    pub fn set_network_bind(&mut self, network_bind: bool) {
+        self.network_bind = network_bind;
+    }
+
     /// Whether inbound MCP auth is disabled — connections may be accepted
     /// without a Bearer token. See [`Self::auth_disabled`] field docs.
     pub fn auth_disabled(&self) -> bool {