MCP Python SDK stops following cross-origin redirects that carried auth headers and request bodies to another host
PR #3448 (merged 2026-09-04) backports #3397 to the v1.x line: `streamable_http_client`, `streamablehttp_client`, `sse_client` and `OAuthClientProvider` now follow a redirect only when it stays on the endpoint's origin (same scheme, host and port, or an http→https upgrade on default ports), keeps the method, and carries no userinfo. Before this, the default client from `create_mcp_http_client` followed every redirect, so a `Location` naming another host moved the connection there with the endpoint's headers, auth and body attached. This is a breaking change: a cross-origin redirect or a 301/302/303 answering a POST now raises `httpx.HTTPStatusError`, and `follow_redirects=True` on a caller-supplied client is no longer consulted. Follow-up #3450 restores relative redirects for endpoint URLs that carry userinfo, which the first check refused too broadly.
Source
↳ Follow the thread