From 76675f5c0abd811d9480e5c9df200cf2060b0218 Mon Sep 17 00:00:00 2001 From: kilarusravankumar Date: Thu, 17 Sep 2026 09:29:10 -0500 Subject: [PATCH] oauthex: build defaultDiscoveryTransport lazily instead of at import defaultDiscoveryTransport was a package-level var, so it got built the moment the package was imported. Building it runs proxyConfigured, which calls http.DefaultTransport's proxy func (that's http.ProxyFromEnvironment). The problem is net/http only reads the proxy env vars once and caches the result forever. So the first call wins, and here that first call happens at import time, before main() has had a chance to set HTTPS_PROXY. By the time the app sets it, it's already too late and the setting gets ignored. You didn't hit this in v1.7.0 because this code didn't exist yet. Just importing .../mcp pulls in oauthex, which was enough to trigger it even if you never called anything in the SDK. Fixing it by wrapping the setup in sync.OnceValue so it runs on first use instead of at import. By then the app has set its proxy env. It's still only built once and reused, same as before. Fixes #1276 --- oauthex/oauth2.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/oauthex/oauth2.go b/oauthex/oauth2.go index caed92ff..0e77149a 100644 --- a/oauthex/oauth2.go +++ b/oauthex/oauth2.go @@ -16,6 +16,7 @@ import ( "net/netip" "net/url" "strings" + "sync" "syscall" "time" @@ -25,7 +26,15 @@ import ( const maxDiscoveryRedirects = 10 -var defaultDiscoveryTransport = newDiscoveryTransport(http.DefaultTransport) +// Build this on first use, not when the package loads. Building it checks the +// proxy via http.ProxyFromEnvironment, and net/http only reads the proxy +// environment once and then remembers it for the whole run. If that happened +// at import time, it would lock in the proxy setting before the app had a +// chance to set HTTPS_PROXY. sync.OnceValue waits until first use and still +// builds the transport just once. See #1276. +var defaultDiscoveryTransport = sync.OnceValue(func() http.RoundTripper { + return newDiscoveryTransport(http.DefaultTransport) +}) type httpStatusError struct { StatusCode int @@ -103,7 +112,7 @@ func checkHTTPSOrLoopback(addr string) error { } func newDiscoveryClient(c *http.Client) *http.Client { - transport := defaultDiscoveryTransport + transport := defaultDiscoveryTransport() if c != nil && c.Transport != nil { // a caller that has taken over dialing or TLS opts out of the checks if t, ok := c.Transport.(*http.Transport); ok && t.DialContext == nil && t.DialTLSContext == nil {