Skip to content

Commit d043de5

Browse files
ipe4647ipe4647
authored
Add forwardAuthorization flag for conditional token forwarding (#147)
* feat(proxy): add forwardAuthorization flag to control token forwarding - Introduced `--proxy-forward-authorization` command line option. - Updated configuration documentation to include new option. - Modified proxy handling to conditionally forward the Authorization header based on the new flag. - Added tests to verify the behavior of the new flag. * test(proxy): add tests for forwardAuthorization flag from env * docs(configuration): update proxy options table formatting to adhere to linter
1 parent 6f6d916 commit d043de5

7 files changed

Lines changed: 242 additions & 32 deletions

File tree

‎docs/docs/configuration.md‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -176,13 +176,14 @@ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048
176176

177177
### Proxy Options
178178

179-
| Option | Environment Variable | Default | Description |
180-
| ----------------------- | --------------------- | ----------- | ----------------------------------------------------------------------------------------------------- |
181-
| `--proxy-bearer-token` | `PROXY_BEARER_TOKEN` | - | Bearer token to add to Authorization header when proxying requests |
182-
| `--proxy-headers` | `PROXY_HEADERS` | - | Comma-separated list of headers to add when proxying requests (format: Header1:Value1,Header2:Value2) |
183-
| `--header-mapping` | `HEADER_MAPPING` | - | Comma-separated mapping of JSON pointer paths to header names (e.g., `/email:X-Forwarded-Email`) |
184-
| `--header-mapping-base` | `HEADER_MAPPING_BASE` | `/userinfo` | JSON pointer base path for header mapping claims lookup (e.g., `/userinfo` or `/`) |
185-
| `--http-streaming-only` | `HTTP_STREAMING_ONLY` | `false` | Reject SSE (GET) requests and keep the backend operating in HTTP streaming-only mode |
186-
| `--trusted-proxies` | `TRUSTED_PROXIES` | - | Comma-separated list of trusted proxies (IP addresses or CIDR ranges) |
179+
| Option | Environment Variable | Default | Description |
180+
| ------------------------------- | ----------------------------- | ----------- | ----------------------------------------------------------------------------------------------------- |
181+
| `--proxy-bearer-token` | `PROXY_BEARER_TOKEN` | - | Bearer token to add to Authorization header when proxying requests |
182+
| `--proxy-forward-authorization` | `PROXY_FORWARD_AUTHORIZATION` | `false` | Forward the incoming Authorization bearer token to the backend after validation |
183+
| `--proxy-headers` | `PROXY_HEADERS` | - | Comma-separated list of headers to add when proxying requests (format: Header1:Value1,Header2:Value2) |
184+
| `--header-mapping` | `HEADER_MAPPING` | - | Comma-separated mapping of JSON pointer paths to header names (e.g., `/email:X-Forwarded-Email`) |
185+
| `--header-mapping-base` | `HEADER_MAPPING_BASE` | `/userinfo` | JSON pointer base path for header mapping claims lookup (e.g., `/userinfo` or `/`) |
186+
| `--http-streaming-only` | `HTTP_STREAMING_ONLY` | `false` | Reject SSE (GET) requests and keep the backend operating in HTTP streaming-only mode |
187+
| `--trusted-proxies` | `TRUSTED_PROXIES` | - | Comma-separated list of trusted proxies (IP addresses or CIDR ranges) |
187188

188189
For practical configuration examples including environment variables, Docker Compose, and Kubernetes deployments, see the [Configuration Examples](./examples.md) page.

‎main.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,7 @@ type proxyRunnerFunc func(
152152
trustedProxy []string,
153153
proxyHeaders []string,
154154
proxyBearerToken string,
155+
forwardAuthorizationHeader bool,
155156
proxyTarget []string,
156157
httpStreamingOnly bool,
157158
headerMapping map[string]string,
@@ -199,6 +200,7 @@ func newRootCommand(run proxyRunnerFunc) *cobra.Command {
199200
var password string
200201
var passwordHash string
201202
var proxyBearerToken string
203+
var forwardAuthorizationHeader bool
202204
var proxyHeaders string
203205
var headerMapping string
204206
var headerMappingBase string
@@ -322,6 +324,7 @@ func newRootCommand(run proxyRunnerFunc) *cobra.Command {
322324
trustedProxiesList,
323325
proxyHeadersList,
324326
proxyBearerToken,
327+
forwardAuthorizationHeader,
325328
args,
326329
httpStreamingOnly,
327330
headerMappingMap,
@@ -376,6 +379,7 @@ func newRootCommand(run proxyRunnerFunc) *cobra.Command {
376379

377380
// Proxy headers configuration
378381
rootCmd.Flags().StringVar(&proxyBearerToken, "proxy-bearer-token", getEnvWithDefault("PROXY_BEARER_TOKEN", ""), "Bearer token to add to Authorization header when proxying requests")
382+
rootCmd.Flags().BoolVar(&forwardAuthorizationHeader, "proxy-forward-authorization", getEnvBoolWithDefault("PROXY_FORWARD_AUTHORIZATION", false), "Forward the incoming Authorization bearer token to the backend after validation")
379383
rootCmd.Flags().StringVar(&trustedProxies, "trusted-proxies", getEnvWithDefault("TRUSTED_PROXIES", ""), "Comma-separated list of trusted proxies (IP addresses or CIDR ranges)")
380384
rootCmd.Flags().StringVar(&proxyHeaders, "proxy-headers", getEnvWithDefault("PROXY_HEADERS", ""), "Comma-separated list of headers to add when proxying requests (format: Header1:Value1,Header2:Value2)")
381385
rootCmd.Flags().BoolVar(&httpStreamingOnly, "http-streaming-only", getEnvBoolWithDefault("HTTP_STREAMING_ONLY", false), "Reject SSE (GET) requests and keep the backend in HTTP streaming-only mode")

‎main_test.go‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,6 +400,7 @@ func TestNewRootCommand_HTTPStreamingOnlyFlag(t *testing.T) {
400400
trustedProxy []string,
401401
proxyHeaders []string,
402402
proxyBearerToken string,
403+
forwardAuthorizationHeader bool,
403404
proxyTarget []string,
404405
httpStreamingOnly bool,
405406
headerMapping map[string]string,
@@ -465,6 +466,7 @@ func TestNewRootCommand_HTTPStreamingOnlyFromEnv(t *testing.T) {
465466
trustedProxy []string,
466467
proxyHeaders []string,
467468
proxyBearerToken string,
469+
forwardAuthorizationHeader bool,
468470
proxyTarget []string,
469471
httpStreamingOnly bool,
470472
headerMapping map[string]string,
@@ -485,3 +487,127 @@ func TestNewRootCommand_HTTPStreamingOnlyFromEnv(t *testing.T) {
485487
t.Fatalf("expected httpStreamingOnly to default to true from env var")
486488
}
487489
}
490+
491+
func TestNewRootCommand_ForwardAuthorizationFlag(t *testing.T) {
492+
t.Setenv("PROXY_FORWARD_AUTHORIZATION", "")
493+
494+
var forwardAuthorization bool
495+
runner := proxyRunnerFunc(func(listen string,
496+
tlsListen string,
497+
autoTLS bool,
498+
tlsHost string,
499+
tlsDirectoryURL string,
500+
tlsAcceptTOS bool,
501+
tlsCertFile string,
502+
tlsKeyFile string,
503+
dataPath string,
504+
repositoryBackend string,
505+
repositoryDSN string,
506+
externalURL string,
507+
googleClientID string,
508+
googleClientSecret string,
509+
googleAllowedUsers []string,
510+
googleAllowedWorkspaces []string,
511+
githubClientID string,
512+
githubClientSecret string,
513+
githubAllowedUsers []string,
514+
githubAllowedOrgs []string,
515+
oidcConfigurationURL string,
516+
oidcClientID string,
517+
oidcClientSecret string,
518+
oidcScopes []string,
519+
oidcUserIDField string,
520+
oidcProviderName string,
521+
oidcAllowedUsers []string,
522+
oidcAllowedUsersGlob []string,
523+
oidcAllowedAttributes map[string][]string,
524+
oidcAllowedAttributesGlob map[string][]string,
525+
noProviderAutoSelect bool,
526+
password string,
527+
passwordHash string,
528+
trustedProxy []string,
529+
proxyHeaders []string,
530+
proxyBearerToken string,
531+
forwardAuthorizationHeader bool,
532+
proxyTarget []string,
533+
httpStreamingOnly bool,
534+
headerMapping map[string]string,
535+
headerMappingBase string,
536+
) error {
537+
forwardAuthorization = forwardAuthorizationHeader
538+
return nil
539+
})
540+
541+
cmd := newRootCommand(runner)
542+
cmd.SetArgs([]string{"--proxy-forward-authorization", "http://backend"})
543+
544+
if err := cmd.Execute(); err != nil {
545+
t.Fatalf("expected command to succeed, got error: %v", err)
546+
}
547+
548+
if !forwardAuthorization {
549+
t.Fatalf("expected forwardAuthorizationHeader to be true when flag is set")
550+
}
551+
}
552+
553+
func TestNewRootCommand_ForwardAuthorizationFromEnv(t *testing.T) {
554+
t.Setenv("PROXY_FORWARD_AUTHORIZATION", "true")
555+
556+
var forwardAuthorization bool
557+
runner := proxyRunnerFunc(func(listen string,
558+
tlsListen string,
559+
autoTLS bool,
560+
tlsHost string,
561+
tlsDirectoryURL string,
562+
tlsAcceptTOS bool,
563+
tlsCertFile string,
564+
tlsKeyFile string,
565+
dataPath string,
566+
repositoryBackend string,
567+
repositoryDSN string,
568+
externalURL string,
569+
googleClientID string,
570+
googleClientSecret string,
571+
googleAllowedUsers []string,
572+
googleAllowedWorkspaces []string,
573+
githubClientID string,
574+
githubClientSecret string,
575+
githubAllowedUsers []string,
576+
githubAllowedOrgs []string,
577+
oidcConfigurationURL string,
578+
oidcClientID string,
579+
oidcClientSecret string,
580+
oidcScopes []string,
581+
oidcUserIDField string,
582+
oidcProviderName string,
583+
oidcAllowedUsers []string,
584+
oidcAllowedUsersGlob []string,
585+
oidcAllowedAttributes map[string][]string,
586+
oidcAllowedAttributesGlob map[string][]string,
587+
noProviderAutoSelect bool,
588+
password string,
589+
passwordHash string,
590+
trustedProxy []string,
591+
proxyHeaders []string,
592+
proxyBearerToken string,
593+
forwardAuthorizationHeader bool,
594+
proxyTarget []string,
595+
httpStreamingOnly bool,
596+
headerMapping map[string]string,
597+
headerMappingBase string,
598+
) error {
599+
forwardAuthorization = forwardAuthorizationHeader
600+
return nil
601+
})
602+
603+
cmd := newRootCommand(runner)
604+
cmd.SetArgs([]string{"http://backend"})
605+
606+
if err := cmd.Execute(); err != nil {
607+
t.Fatalf("expected command to succeed, got error: %v", err)
608+
}
609+
610+
if !forwardAuthorization {
611+
t.Fatalf("expected forwardAuthorizationHeader to default to true from env var")
612+
}
613+
}

‎pkg/mcp-proxy/main.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ func Run(
7474
trustedProxy []string,
7575
proxyHeaders []string,
7676
proxyBearerToken string,
77+
forwardAuthorizationHeader bool,
7778
proxyTarget []string,
7879
httpStreamingOnly bool,
7980
headerMapping map[string]string,
@@ -298,7 +299,7 @@ func Run(
298299
if err != nil {
299300
return fmt.Errorf("failed to create IDP router: %w", err)
300301
}
301-
proxyRouter, err := newProxyRouter(externalURL, beHandler, &privKey.PublicKey, proxyHeadersMap, httpStreamingOnly, headerMapping, headerMappingBase)
302+
proxyRouter, err := newProxyRouter(externalURL, beHandler, &privKey.PublicKey, proxyHeadersMap, httpStreamingOnly, forwardAuthorizationHeader, headerMapping, headerMappingBase)
302303
if err != nil {
303304
return fmt.Errorf("failed to create proxy router: %w", err)
304305
}

‎pkg/mcp-proxy/main_test.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ func TestRun_NormalizesExternalURLTrailingSlash(t *testing.T) {
3434
for _, tt := range cases {
3535
t.Run(tt.name, func(t *testing.T) {
3636
var receivedURL string
37-
newProxyRouter = func(externalURL string, proxyHandler http.Handler, publicKey *rsa.PublicKey, proxyHeaders http.Header, httpStreamingOnly bool, headerMapping map[string]string, headerMappingBase string) (*proxy.ProxyRouter, error) {
37+
newProxyRouter = func(externalURL string, proxyHandler http.Handler, publicKey *rsa.PublicKey, proxyHeaders http.Header, httpStreamingOnly bool, forwardAuthorizationHeader bool, headerMapping map[string]string, headerMappingBase string) (*proxy.ProxyRouter, error) {
3838
receivedURL = externalURL
3939
return nil, errors.New("stop early")
4040
}
@@ -46,7 +46,7 @@ func TestRun_NormalizesExternalURLTrailingSlash(t *testing.T) {
4646
"", "", nil, nil,
4747
"", "", nil, nil,
4848
"", "", "", nil, "", "", nil, nil, nil, nil,
49-
false, "", "", nil, nil, "",
49+
false, "", "", nil, nil, "", false,
5050
[]string{"http://example.com"}, false, nil, "/userinfo",
5151
)
5252

@@ -70,7 +70,7 @@ func TestRun_PassesHTTPStreamingOnlyToProxyRouter(t *testing.T) {
7070
})
7171

7272
var streamingOnlyReceived bool
73-
newProxyRouter = func(externalURL string, proxyHandler http.Handler, publicKey *rsa.PublicKey, proxyHeaders http.Header, httpStreamingOnly bool, headerMapping map[string]string, headerMappingBase string) (*proxy.ProxyRouter, error) {
73+
newProxyRouter = func(externalURL string, proxyHandler http.Handler, publicKey *rsa.PublicKey, proxyHeaders http.Header, httpStreamingOnly bool, forwardAuthorizationHeader bool, headerMapping map[string]string, headerMappingBase string) (*proxy.ProxyRouter, error) {
7474
streamingOnlyReceived = httpStreamingOnly
7575
return nil, errors.New("proxy router init failed")
7676
}
@@ -112,6 +112,7 @@ func TestRun_PassesHTTPStreamingOnlyToProxyRouter(t *testing.T) {
112112
nil,
113113
nil,
114114
"",
115+
false,
115116
[]string{"http://example.com"},
116117
true,
117118
nil,

‎pkg/proxy/proxy.go‎

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,14 @@ import (
1212
)
1313

1414
type ProxyRouter struct {
15-
externalURL string
16-
proxy http.Handler
17-
publicKey *rsa.PublicKey
18-
proxyHeaders http.Header
19-
httpStreamingOnly bool
20-
headerMapping map[string]string
21-
headerMappingBase string
15+
externalURL string
16+
proxy http.Handler
17+
publicKey *rsa.PublicKey
18+
proxyHeaders http.Header
19+
httpStreamingOnly bool
20+
forwardAuthorizationHeader bool
21+
headerMapping map[string]string
22+
headerMappingBase string
2223
}
2324

2425
func NewProxyRouter(
@@ -27,17 +28,19 @@ func NewProxyRouter(
2728
publicKey *rsa.PublicKey,
2829
proxyHeaders http.Header,
2930
httpStreamingOnly bool,
31+
forwardAuthorizationHeader bool,
3032
headerMapping map[string]string,
3133
headerMappingBase string,
3234
) (*ProxyRouter, error) {
3335
return &ProxyRouter{
34-
externalURL: externalURL,
35-
proxy: proxy,
36-
publicKey: publicKey,
37-
proxyHeaders: proxyHeaders,
38-
httpStreamingOnly: httpStreamingOnly,
39-
headerMapping: headerMapping,
40-
headerMappingBase: headerMappingBase,
36+
externalURL: externalURL,
37+
proxy: proxy,
38+
publicKey: publicKey,
39+
proxyHeaders: proxyHeaders,
40+
httpStreamingOnly: httpStreamingOnly,
41+
forwardAuthorizationHeader: forwardAuthorizationHeader,
42+
headerMapping: headerMapping,
43+
headerMappingBase: headerMappingBase,
4144
}, nil
4245
}
4346

@@ -87,8 +90,13 @@ func (p *ProxyRouter) handleProxy(c *gin.Context) {
8790
return
8891
}
8992

90-
c.Request.Header.Del("Authorization")
93+
if !p.forwardAuthorizationHeader {
94+
c.Request.Header.Del("Authorization")
95+
}
9196
for key, values := range p.proxyHeaders {
97+
if strings.EqualFold(key, "Authorization") {
98+
c.Request.Header.Del("Authorization")
99+
}
92100
for _, value := range values {
93101
c.Request.Header.Add(key, value)
94102
}

0 commit comments

Comments
 (0)