Add forwardAuthorization flag for conditional token forwarding by ipe4647 · Pull Request #147 · sigbit/mcp-auth-proxy

ipe4647 · 2026-04-23T10:13:59Z

Introduce a new configuration option to control whether the incoming Authorization bearer token is forwarded to the backend after validation. By default, the proxy strips the Authorization header before forwarding requests, but with the new --proxy-forward-authorization flag (or PROXY_FORWARD_AUTHORIZATION environment variable), this behavior can be changed. The implementation includes updates to the CLI, configuration, proxy logic, and comprehensive tests to cover the new functionality.

New Authorization Forwarding Feature:

Added the --proxy-forward-authorization CLI flag and PROXY_FORWARD_AUTHORIZATION environment variable, allowing users to forward the incoming Authorization bearer token to the backend after validation. This is documented in configuration.md and wired into the CLI and environment variable parsing. [1] [2] [3]
Updated the proxy runner, main logic, and proxy router to accept and propagate the new forwardAuthorizationHeader boolean parameter throughout the application. [1] [2] [3] [4] [5] [6] [7]

Proxy Logic Changes:

Modified the proxy handler so that, by default, the Authorization header is stripped before forwarding requests. If the new flag is enabled, the header is preserved and forwarded to the backend.

Testing Enhancements:

Added and updated tests to verify the new behavior, including a dedicated test to ensure the Authorization header is stripped by default and forwarded when the flag is set. Tests were also updated to pass the new parameter to the proxy router where needed. [1] [2] [3] [4] [5] [6] [7] [8]

These changes provide users with more control over how authentication information is handled when proxying requests, improving flexibility and security.- Introduced --proxy-forward-authorization command line option.

Updated configuration documentation to include new option.
Modified proxy handling to conditionally forward the Authorization header based on the new flag.
Added tests to verify the behavior of the new flag.

Summary

Now possible to pass JWT token towards backend servers for identity mapping via Authorization header.

Type of Change

- Introduced `--proxy-forward-authorization` command line option. - Updated configuration documentation to include new option. - Modified proxy handling to conditionally forward the Authorization header based on the new flag. - Added tests to verify the behavior of the new flag.

Copilot

Pull request overview

Adds a configuration flag to optionally forward the incoming Authorization: Bearer … header to the backend after the proxy validates the token, instead of stripping it by default.

Changes:

Introduces --proxy-forward-authorization / PROXY_FORWARD_AUTHORIZATION and wires it through CLI → runner → proxy router.
Updates proxy routing logic to conditionally retain or strip the Authorization header, while still allowing configured proxy headers to override it.
Adds/updates tests to cover default stripping and explicit forwarding behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`pkg/proxy/proxy.go`	Adds `forwardAuthorizationHeader` to `ProxyRouter` and conditionally strips `Authorization` before proxying.
`pkg/proxy/proxy_test.go`	Updates router construction for new parameter and adds tests for default strip vs enabled forward behavior.
`pkg/mcp-proxy/main.go`	Propagates the new forwarding boolean into `NewProxyRouter` creation.
`main.go`	Adds CLI flag/env default parsing and passes the new parameter into the runner.
`main_test.go`	Extends runner signature and adds a CLI-flag test for `--proxy-forward-authorization`.
`docs/docs/configuration.md`	Documents the new CLI flag and environment variable in configuration docs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-23T10:17:50Z

+func TestNewRootCommand_ForwardAuthorizationFlag(t *testing.T) {
+	t.Setenv("PROXY_FORWARD_AUTHORIZATION", "")
+
+	var forwardAuthorization bool


The new --proxy-forward-authorization flag is tested, but there’s no test that verifies the PROXY_FORWARD_AUTHORIZATION environment variable is correctly wired into newRootCommand (e.g., catching a typo in the env var name). Consider adding a TestNewRootCommand_ForwardAuthorizationFromEnv similar to TestNewRootCommand_HTTPStreamingOnlyFromEnv.

hrntknr · 2026-04-23T12:15:24Z

Thanks for the PR! Before going deeper, could you share a bit more about the use case?
The proxy already has --header-mapping for passing JWT claims to the backend, so I'm curious what made forwarding the raw Authorization header necessary on top of that. Is there a specific backend (Spring Security, Envoy JWT filter, etc.) that expects the token there directly?
Also worth noting: the JWT in that header is signed by this proxy, not by the upstream IdP. So forwarding it is only useful if the backend verifies it with the proxy's public key — which would need a JWKS endpoint we don't expose yet.
Knowing what your backend does with the header (reads claims? verifies signature?) would help decide the right shape here. Thanks!

ipe4647 · 2026-04-23T12:35:31Z

Thanks for the PR! Before going deeper, could you share a bit more about the use case? The proxy already has --header-mapping for passing JWT claims to the backend, so I'm curious what made forwarding the raw Authorization header necessary on top of that. Is there a specific backend (Spring Security, Envoy JWT filter, etc.) that expects the token there directly?

Hi! I have a use case so that the mcp-auth-proxy would be used as authenticator (that is DCR capable since Entra doesn't support it) and the authorization is made in the backend server. The exact use case is to use mcp-grafana that passes the Authorization towards Grafana where i can have JWT auth that authorizes specific user. I don't want to use JWT claim mapping because they can be spoofed. (Let me know if i have missed something.)

Also worth noting: the JWT in that header is signed by this proxy, not by the upstream IdP. So forwarding it is only useful if the backend verifies it with the proxy's public key — which would need a JWKS endpoint we don't expose yet. Knowing what your backend does with the header (reads claims? verifies signature?) would help decide the right shape here.

The JWKS endpoint is exposed in /.well-known/jwks.json already that can be used for validating JWT-s.

I have validated this use case and it's working as i need it.

hrntknr · 2026-04-23T12:39:02Z

Oh, there was indeed a JWKS endpoint... thank you

hrntknr · 2026-04-23T12:41:57Z

Ah, I see now. You want mcp-auth-proxy to function as a lightweight DCR adapter that doesn't perform any authentication or authorization itself.

ipe4647 · 2026-04-23T12:44:44Z

Ah, I see now. You want mcp-auth-proxy to function as a lightweight DCR adapter that doesn't perform any authentication or authorization itself.

Well it authenticates and passes the authentication tokens onwards :)

hrntknr

Thanks for the fix, and thanks for the report about the spoofing issue too.

hrntknr · 2026-04-23T12:59:59Z

Please fix only the lint issues.

codecov · 2026-04-23T13:00:45Z

Codecov Report

❌ Patch coverage is 83.33333% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/proxy/proxy.go	78.57%	2 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

…to linter

Copilot AI review requested due to automatic review settings April 23, 2026 10:14

Copilot started reviewing on behalf of ipe4647 April 23, 2026 10:14 View session

Copilot AI reviewed Apr 23, 2026

View reviewed changes

hrntknr self-requested a review April 23, 2026 12:13

test(proxy): add tests for forwardAuthorization flag from env

e9c49be

hrntknr approved these changes Apr 23, 2026

View reviewed changes

hrntknr mentioned this pull request Apr 23, 2026

fix(proxy): strip client-supplied header-mapping target headers #148

Merged

4 tasks

docs(configuration): update proxy options table formatting to adhere …

67217f6

…to linter

hrntknr merged commit d043de5 into sigbit:main Apr 23, 2026
10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add forwardAuthorization flag for conditional token forwarding#147

Add forwardAuthorization flag for conditional token forwarding#147
hrntknr merged 3 commits intosigbit:mainfrom
ipe4647:feat/auth-header-forwarding

ipe4647 commented Apr 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 23, 2026

Uh oh!

hrntknr commented Apr 23, 2026

Uh oh!

ipe4647 commented Apr 23, 2026

Uh oh!

hrntknr commented Apr 23, 2026 •

edited

Loading

Uh oh!

hrntknr commented Apr 23, 2026

Uh oh!

ipe4647 commented Apr 23, 2026

Uh oh!

hrntknr left a comment

Uh oh!

hrntknr commented Apr 23, 2026

Uh oh!

codecov Bot commented Apr 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

ipe4647 commented Apr 23, 2026

Summary

Type of Change

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

hrntknr commented Apr 23, 2026

Uh oh!

ipe4647 commented Apr 23, 2026

Uh oh!

hrntknr commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hrntknr commented Apr 23, 2026

Uh oh!

ipe4647 commented Apr 23, 2026

Uh oh!

hrntknr left a comment

Choose a reason for hiding this comment

Uh oh!

hrntknr commented Apr 23, 2026

Uh oh!

codecov Bot commented Apr 23, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hrntknr commented Apr 23, 2026 •

edited

Loading