Skip to content

Validation

validation

Input validation utilities for OAuth endpoints.

validate_client_id 

validate_client_id(client_id: str) -> bool

Validate client_id format to prevent injection attacks.

Parameters:

Name Type Description Default
client_id str

The client identifier to validate

 required

Returns:

Type Description
bool

True if valid, False otherwise

Valid client IDs must: - Contain only alphanumeric characters, hyphens, and underscores - Be between 1 and 256 characters long

Source code in mcp_authflow/validation.py 
11
12
13
14
15
16
17
18
19
20
21
22
23
24
def validate_client_id(client_id: str) -> bool:
    """Validate client_id format to prevent injection attacks.

    Args:
        client_id: The client identifier to validate

    Returns:
        True if valid, False otherwise

    Valid client IDs must:
    - Contain only alphanumeric characters, hyphens, and underscores
    - Be between 1 and 256 characters long
    """
    return bool(VALID_ID_PATTERN.match(client_id))

parse_json_field 

parse_json_field(
    value: str | list[str] | None, default: list[str]
) -> list[str]

Parse a JSON string field into a list of strings.

Accepts a JSON-encoded array string, a list of strings, or None. Non-list results (e.g. a JSON object or scalar) return the default.

Parameters:

Name Type Description Default
value str | list[str] | None

The value to parse (JSON string, list, or None)

 required
default list[str]

Default value to return if parsing fails or value is falsy

 required

Returns:

Type Description
list[str]

Parsed list or default
Source code in mcp_authflow/validation.py 
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
def parse_json_field(
    value: str | list[str] | None,
    default: list[str],
) -> list[str]:
    """Parse a JSON string field into a list of strings.

    Accepts a JSON-encoded array string, a list of strings, or None.
    Non-list results (e.g. a JSON object or scalar) return the default.

    Args:
        value: The value to parse (JSON string, list, or None)
        default: Default value to return if parsing fails or value is falsy

    Returns:
        Parsed list or default
    """
    if not value:
        return default
    if isinstance(value, list):
        return value
    if not isinstance(value, str):
        return default
    try:
        parsed = json.loads(value)
        return parsed if isinstance(parsed, list) else default
    except json.JSONDecodeError:
        return default

parse_scope_field 

parse_scope_field(scopes: str | list[str] | None) -> str

Parse OAuth scope field into a space-separated string.

Handles multiple formats: - List of strings: ["read", "write"] -> "read write" - JSON string array: '["read", "write"]' -> "read write" - Space-separated string: "read write" -> "read write"

Parameters:

Name Type Description Default
scopes str | list[str] | None

Scope value in any supported format

 required

Returns:

Type Description
str

Space-separated scope string
Source code in mcp_authflow/validation.py 
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
def parse_scope_field(scopes: str | list[str] | None) -> str:
    """Parse OAuth scope field into a space-separated string.

    Handles multiple formats:
    - List of strings: ["read", "write"] -> "read write"
    - JSON string array: '["read", "write"]' -> "read write"
    - Space-separated string: "read write" -> "read write"

    Args:
        scopes: Scope value in any supported format

    Returns:
        Space-separated scope string
    """
    if not scopes:
        return "read"
    if isinstance(scopes, list):
        return " ".join(scopes)
    if scopes.startswith("["):
        try:
            parsed = json.loads(scopes)
            return " ".join(parsed) if isinstance(parsed, list) else scopes
        except json.JSONDecodeError:
            return scopes
    return scopes