Skip to content

Follow HTTP redirects in transparent proxy#4454

Open
gkatz2 wants to merge 1 commit intostacklok:mainfrom
gkatz2:fix/proxy-follow-redirects-4453
Open

Follow HTTP redirects in transparent proxy#4454
gkatz2 wants to merge 1 commit intostacklok:mainfrom
gkatz2:fix/proxy-follow-redirects-4453

Conversation

@gkatz2
Copy link
Copy Markdown
Contributor

@gkatz2 gkatz2 commented Mar 31, 2026

Summary

  • MCP clients cannot handle HTTP redirect responses (they expect JSON-RPC), so when a remote server redirects, the client silently fails. The transparent proxy now follows redirects in its forward method before returning the response to the client.
  • Adds an isRedirectStatus helper that handles 301, 302, 307, and 308. The HTTP method and body are preserved across redirects via req.Clone(). A maxRedirects limit of 10 prevents infinite loops.
  • Logs at WARN level on each redirect to nudge operators toward fixing the server URL.

Fixes #4453

Type of change

  • Bug fix
  • New feature
  • Refactoring (no behavior change)
  • Dependency update
  • Documentation
  • Other (describe):

Test plan

  • Unit tests (task test)
  • E2E tests (task test-e2e)
  • Linting (task lint-fix)
  • Manual testing (describe below)

Tested with a local HTTP server returning 308 redirects to a running MCP server (design-system-mcp). Verified:

  • initialize call succeeds through the redirect
  • Proxy logs show the WARN message with from/to URLs and redirect count

Does this introduce a user-facing change?

Remote MCP servers behind HTTP redirects now work. Previously, the proxy passed redirect responses to the client, causing silent failures. No configuration needed — redirect following is automatic.

Special notes for reviewers

  • The redirect logic lives in forward rather than RoundTrip so that session tracking, 401 handling, and DELETE cleanup in RoundTrip only see the final response after all redirects are resolved.
  • 303 (See Other) is excluded from isRedirectStatus because it explicitly requires changing the method to GET, which would break JSON-RPC.

Generated with Claude Code

MCP clients expect JSON-RPC responses and cannot handle
HTTP redirects. When a remote server returns a 3xx redirect,
the proxy now follows it transparently instead of passing
the redirect response to the client.

Fixes stacklok#4453

Signed-off-by: Greg Katz <gkatz@indeed.com>
@github-actions github-actions bot added the size/M Medium PR: 300-599 lines changed label Mar 31, 2026
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 31, 2026

Codecov Report

❌ Patch coverage is 78.94737% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.61%. Comparing base (11cd266) to head (0eed864).

Files with missing lines Patch % Lines
...g/transport/proxy/transparent/transparent_proxy.go 78.94% 5 Missing and 3 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4454      +/-   ##
==========================================
+ Coverage   69.57%   69.61%   +0.04%     
==========================================
  Files         489      489              
  Lines       50193    50228      +35     
==========================================
+ Hits        34920    34965      +45     
+ Misses      12590    12575      -15     
- Partials     2683     2688       +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/M Medium PR: 300-599 lines changed

1 participant