Any plans for very basic authentication handling?

[stdweird]

Are there any plans (or interest even) to add some basic authentication (username+password; or some secret set via eg the env or cli , and passed by mcp client via a header)? I am aware that this might slide into supporting auth backend XYZ; but no auth at all is also not a lot. In our case, we would run (or try to) mulitple containers with mcp-run-python behind a proxy; but we'd prefer not having to add another nginx inbetween to handle our requirement that only the proxy can use the mcp-run-python service.

[DouweM]

@stdweird I agree some authentication would be valuable to have. The simplest thing would be bearer token auth with a static token that's read from an env var. Would that be sufficient for you?

[stdweird]

@DouweM yes, that would be perfect. thanks for considering it!

[DouweM]

@stdweird Would you be up for a contribution? :)

[stdweird]

@DouweM my typescript knowledge is non-existing; i can ask a LLM to generate it, but not sure you'd want that

[stdweird]

@DouweM this is what gpt5 came up with. it assumes the bearer token is always present (which you probably don't want)
also in light of #15 probably needs to be factored out a bit so it can be used in both statefull and stateless server?

anyway, i feel this is beyond my skills (and having #15 merged is probably also needed to make a clean patch)

import http from 'http'
import { randomUUID } from 'crypto'
import { timingSafeEqual } from 'crypto'
// ... other imports: createServer, StreamableHTTPServerTransport, httpGetUrl, httpGetBody, httpSetTextResponse, httpSetJsonResponse, isInitializeRequest

function getBearerToken(req: http.IncomingMessage): string | null {
  const auth = req.headers['authorization']
  if (!auth || Array.isArray(auth)) return null
  const [scheme, ...rest] = auth.trim().split(/\s+/)
  if (!scheme || scheme.toLowerCase() !== 'bearer') return null
  const token = rest.join(' ')
  return token || null
}

function safeEquals(a: string, b: string): boolean {
  // Compare using timing-safe logic; fall back to normal compare if lengths differ
  const aBuf = Buffer.from(a)
  const bBuf = Buffer.from(b)
  if (aBuf.length !== bBuf.length) return false
  return timingSafeEqual(aBuf, bBuf)
}

export function createStatefulHttpServer(deps: string[], returnMode: string): http.Server {
  const mcpServer = createServer(deps, returnMode)
  const transports: { [sessionId: string]: StreamableHTTPServerTransport } = {}

  return http.createServer(async (req, res) => {
    const url = httpGetUrl(req)

    // --- Basic auth via Bearer token ---
    // Allow CORS preflight and a simple health check without auth (optional)
    if (req.method === 'OPTIONS') {
      res.writeHead(204, {
        'Access-Control-Allow-Origin': '*',
        'Access-Control-Allow-Methods': 'GET,POST,DELETE,OPTIONS',
        'Access-Control-Allow-Headers': 'Authorization,Content-Type,mcp-session-id',
        'Access-Control-Max-Age': '600',
      })
      res.end()
      return
    }

    if (url.pathname === '/health') {
      res.writeHead(200, { 'Content-Type': 'text/plain' })
      res.end('ok')
      return
    }

    const expected = process.env.SECRET_TOKEN
    if (!expected) {
      // Fail closed if env is missing; safer than allowing unauthenticated access by accident
      res.writeHead(500, { 'Content-Type': 'text/plain' })
      res.end('Server misconfiguration: SECRET_TOKEN is not set')
      return
    }

    const provided = getBearerToken(req)
    if (!provided || !safeEquals(provided, expected)) {
      res.writeHead(401, {
        'Content-Type': 'text/plain',
        'WWW-Authenticate': 'Bearer realm="mcp", error="invalid_token"',
      })
      res.end('Unauthorized')
      return
    }
    // --- End auth guard ---

   ....

[DouweM]

@stdweird I'm not a TS expert either I'm afraid, but I'll ask someone else from our side to have a look!

[dsfaccini]

for getting the basic auth value you can modify the getBearer function like

function getBasicToken(req: http.IncomingMessage): string | null {
  const auth = req.headers['authorization']
  if (!auth || Array.isArray(auth)) return null
  const [scheme, ...rest] = auth.trim().split(/\s+/)
  if (!scheme || scheme.toLowerCase() !== 'basic') return null
  const token = rest.join(' ')
  return token || null
}

basic auth is just a base64 string of user:password, so to decode it you can

const users = {"stdweird": "is it std? is it weird?"}
const token = getBasicToken(req)
if (!token) return unauthorized()

// token is base64("user:pass") so we decode it
const decoded = Buffer.from(token, 'base64').toString('utf8')
const [user, password] = decoded.split(':', 2)

const expected = users?.[user]
if (expected && expected === password) {
  // ok
} else {
  // unauthorized
}

[DouweM]

@dsfaccini Feel free to submit a PR! Note that I don't think we need to support basic auth, I'd rather just have bearer token.