Module 3 · Running servers in production · Lesson 6
Remote servers and authorization
Serve an MCP server over Streamable HTTP as a stateless OAuth resource server, with per-request instances, Host and Origin checks, protected resource metadata, and tokens checked for issuer, audience and scope before they are mapped to a user.
By the end of this lesson you can
- Serve a server over Streamable HTTP with a per-request factory, and measure what statelessness costs and buys
- Protect a locally bound HTTP server against DNS rebinding with Host and Origin validation
- Trace MCP's authorization flow from a 401 challenge through protected resource metadata, client registration, PKCE and the issuer check to a bearer token
- Verify an access token's signature, issuer, audience, expiry and scopes, and map its subject to a user without passing the token downstream
- Connect Claude Code to a remote server, and list what a hosted Claude connector needs from one