Add header to MCP server to expand authentication capabilities #229
Conversation
|
This merge request would help me too. I would like to forward the authorization headers from the user to the actual tool use. So that the tool request can be done "in the name" of the original user. The backend is filtering out data based on the users permissions so i can not just use a service account for that. |
|
The addition of this feature is proposed by our team, the starting point is to strengthen the ability of mcp, and then the actual use of the process, we hope that he can be used as we use http network requests, you can isolate the user's request for business data and some of the system data, you can do more things, for example, we can add the header object to add sourceclient to determine the source of the user , you can add the header object auth_token to do the login credentials to pass , you can add any field to do the B-side of the user wants to do things , such as adding a parameter encryption field , you can do some of the anti-climbing mechanism and so on. |
Motivation and Context
This change introduces header-based authentication for MCP, improving security and access control. By requiring authentication headers in requests, we ensure that only authorized users can interact with MCP services.
How Has This Been Tested?
Breaking Changes
No breaking changes; existing authentication mechanisms remain functional, and this addition does not affect previous implementations.
Types of changes
Checklist
Additional Context
This implementation enhances security while keeping the request structure simple and efficient. No changes were made to the core authentication logic beyond requiring the new header.