modelcontextprotocol/example-remote-server
Watch
1
0
Fork
You've already forked example-remote-server
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #4 from modelcontextprotocol/pcarleton/prm-www

Browse source 
Add PRM metadata to www-authenticate
This commit is contained in:
Jerome 2025-07-22 13:58:33 +01:00 • committed by GitHub
commit a7b1083243
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/index.ts
View file

@ -1,5 +1,5 @@
import { BearerAuthMiddlewareOptions, requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js"; import { BearerAuthMiddlewareOptions, requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
import { AuthRouterOptions, mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js"; import { AuthRouterOptions, getOAuthProtectedResourceMetadataUrl, mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
import cors from "cors"; import cors from "cors";
import express from "express"; import express from "express";
import path from "path"; import path from "path";
@ -44,13 +44,13 @@ const baseSecurityHeaders = (req: express.Request, res: express.Response, next:
// Structured logging middleware // Structured logging middleware
const loggingMiddleware = (req: express.Request, res: express.Response, next: express.NextFunction) => { const loggingMiddleware = (req: express.Request, res: express.Response, next: express.NextFunction) => {
const startTime = Date.now(); const startTime = Date.now();
// Sanitize headers to remove sensitive information // Sanitize headers to remove sensitive information
const sanitizedHeaders = { ...req.headers }; const sanitizedHeaders = { ...req.headers };
delete sanitizedHeaders.authorization; delete sanitizedHeaders.authorization;
delete sanitizedHeaders.cookie; delete sanitizedHeaders.cookie;
delete sanitizedHeaders['x-api-key']; delete sanitizedHeaders['x-api-key'];
// Log request (without sensitive data) // Log request (without sensitive data)
logger.info('Request received', { logger.info('Request received', {
method: req.method, method: req.method,
@ -145,7 +145,8 @@ const dearerAuthMiddlewareOptions: BearerAuthMiddlewareOptions = {
// verifyAccessToken(token: string): Promise<AuthInfo>; // verifyAccessToken(token: string): Promise<AuthInfo>;
verifier: { verifier: {
verifyAccessToken: authProvider.verifyAccessToken.bind(authProvider), verifyAccessToken: authProvider.verifyAccessToken.bind(authProvider),
} },
resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(new URL(BASE_URI)),
} }
app.use(mcpAuthRouter(options)); app.use(mcpAuthRouter(options));
@ -166,7 +167,7 @@ app.get("/mcp-logo.png", (req, res) => {
res.sendFile(logoPath); res.sendFile(logoPath);
}); });
// Upstream auth routes // Upstream auth routes
app.get("/fakeupstreamauth/authorize", cors(corsOptions), handleFakeAuthorize); app.get("/fakeupstreamauth/authorize", cors(corsOptions), handleFakeAuthorize);
app.get("/fakeupstreamauth/callback", cors(corsOptions), handleFakeAuthorizeRedirect); app.get("/fakeupstreamauth/callback", cors(corsOptions), handleFakeAuthorizeRedirect);