Struct OauthHttpClient 

pub struct OauthHttpClient { /* private fields */ }

HTTP client used by exchange_token and the OAuth 2.1 proxy handlers (handle_token, handle_introspect, handle_revoke).

Wraps an internal HTTP backend so callers do not depend on the concrete crate. Construct one per process and reuse across requests (the underlying connection pool is shared internally via Clone - cheap, refcounted).

Hardening (since 1.2.1). When constructed via with_config (preferred), the internal client refuses any redirect that downgrades the scheme from https to http, even when the original request URL was HTTPS. This closes a class of metadata-poisoning attacks where a hostile or compromised upstream IdP returns 302 Location: http://... and the resulting plaintext hop is intercepted by a network-positioned attacker to siphon bearer tokens, refresh tokens, or introspection traffic. When the caller has set OAuthConfig::allow_http_oauth_urls to true (development only), HTTP-to-HTTP redirects are still permitted but HTTPS-to-HTTP downgrades are always rejected.

with_config also honours OAuthConfig::ca_cert_path (if set) and adds the supplied PEM CA bundle to the system roots so that every OAuth-bound HTTP request – not just the JWKS fetch – can trust enterprise/internal certificate authorities. This restores the behaviour that existed pre-0.10.0 before the OauthHttpClient wrapper landed.

The legacy new constructor (no-arg) is preserved for source compatibility but is #[deprecated]: it returns a client with system-roots-only TLS trust and the strictest redirect policy (HTTPS-only, never permits plain HTTP). Migrate to with_config at the earliest opportunity so that token / introspection / revocation / exchange traffic inherits the same CA trust and allow_http_oauth_urls toggle as the JWKS fetch client.

Implementations

impl OauthHttpClient

pub fn with_config(config: &OAuthConfig) -> Result<Self, McpxError>

Build a client from the OAuth configuration (preferred since 1.2.1).

Defaults: connect_timeout = 10s, total timeout = 30s, scheme-downgrade-rejecting redirect policy (max 2 hops), optional custom CA trust via OAuthConfig::ca_cert_path, and HTTP-to-HTTP redirects gated by OAuthConfig::allow_http_oauth_urls (dev-only).

Pass the same &OAuthConfig you supplied to JwksCache::new / serve() so the OAuth-bound HTTP traffic inherits identical CA trust and HTTPS-only redirect policy.

Errors

Returns crate::error::McpxError::Startup if the configured ca_cert_path cannot be read or parsed, or if the underlying HTTP client cannot be constructed (e.g. TLS backend init failure).

pub fn new() -> Result<Self, McpxError>

👎Deprecated since 1.2.1:

use OauthHttpClient::with_config(&OAuthConfig) so token/introspect/revoke/exchange traffic inherits ca_cert_path and the allow_http_oauth_urls toggle

Build a client with default settings (system CA roots only, strict HTTPS-only redirect policy).

Deprecated since 1.2.1. This constructor cannot honour OAuthConfig::ca_cert_path (so token / introspection / revocation / exchange traffic falls back to the system trust store, breaking enterprise PKI deployments) and ignores the OAuthConfig::allow_http_oauth_urls dev-mode toggle (so HTTP-to-HTTP redirects are unconditionally refused). Both of these are bugs that the new with_config constructor fixes.

The redirect policy still rejects https -> http downgrades, matching the security posture of with_config.

Migrate to with_config and pass the same &OAuthConfig your serve() call uses.

Errors

Returns crate::error::McpxError::Startup if the underlying HTTP client cannot be constructed (e.g. TLS backend init failure).

Trait Implementations

impl Clone for OauthHttpClient

fn clone(&self) -> OauthHttpClient

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OauthHttpClient

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.