auth: Add HTTP-based authentication support to validate domain ownership (#282)
Add HTTP-based authentication to prove domain ownership, similar to https://github.com/modelcontextprotocol/registry/pull/238's DNS authentication but using HTTPS well-known URIs instead of DNS TXT records. Fixes #280 ## Motivation and Context Some organizations don't have easy access to DNS records, but can easily deploy web assets. They would therefore prefer to be able to complete a HTTP challenge rather than a DNS one to authenticate to the registry. This would in some way mirror ACME challenges: where you can do a DNS-01 or a HTTP-01 challenge. ## How Has This Been Tested? - Tested locally by stubbing out the HTTP getter - Added unit tests ## Breaking Changes None ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply. --> - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context I concern I had when building this that it might expose us to SSRF attacks. I think on reflection this is not a significant problem: - We only GET a fixed file `.well-known/mcp-registry-auth` (redirects disallowed) after sanitizing the domain, and then also don't expose the response to the user. This means the user shouldn't be able to hit anything very interesting. - The information they might get is what domains/servers exist in the network. Our infrastructure is already all open-source, so attackers aren't getting any additional real info by prodding at the environment this way.
This commit is contained in:
adam jones
GitHub
parent
316cbb08ee
commit
ee910ca286
3 changed files with 678 additions and 118 deletions
121
tools/publisher/auth/common.go
Normal file
121
tools/publisher/auth/common.go
Normal file
|
|
@ -0,0 +1,121 @@
|
|||
package auth
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"time"
|
||||
)
|
||||
|
||||
// CryptoProvider provides common functionality for DNS and HTTP authentication
|
||||
type CryptoProvider struct {
|
||||
registryURL string
|
||||
domain string
|
||||
hexSeed string
|
||||
authMethod string
|
||||
}
|
||||
|
||||
// GetToken retrieves the registry JWT token using cryptographic authentication
|
||||
func (c *CryptoProvider) GetToken(ctx context.Context) (string, error) {
|
||||
if c.domain == "" {
|
||||
return "", fmt.Errorf("%s domain is required", c.authMethod)
|
||||
}
|
||||
|
||||
if c.hexSeed == "" {
|
||||
return "", fmt.Errorf("%s private key (hex seed) is required", c.authMethod)
|
||||
}
|
||||
|
||||
// Decode hex seed to private key
|
||||
seedBytes, err := hex.DecodeString(c.hexSeed)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("invalid hex seed format: %w", err)
|
||||
}
|
||||
|
||||
if len(seedBytes) != ed25519.SeedSize {
|
||||
return "", fmt.Errorf("invalid seed length: expected %d bytes, got %d", ed25519.SeedSize, len(seedBytes))
|
||||
}
|
||||
|
||||
privateKey := ed25519.NewKeyFromSeed(seedBytes)
|
||||
|
||||
// Generate current timestamp
|
||||
timestamp := time.Now().UTC().Format(time.RFC3339)
|
||||
|
||||
// Sign the timestamp
|
||||
signature := ed25519.Sign(privateKey, []byte(timestamp))
|
||||
signedTimestamp := hex.EncodeToString(signature)
|
||||
|
||||
// Exchange signature for registry token
|
||||
registryToken, err := c.exchangeTokenForRegistry(ctx, c.domain, timestamp, signedTimestamp)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to exchange %s signature: %w", c.authMethod, err)
|
||||
}
|
||||
|
||||
return registryToken, nil
|
||||
}
|
||||
|
||||
// NeedsLogin always returns false for cryptographic auth since no interactive login is needed
|
||||
func (c *CryptoProvider) NeedsLogin() bool {
|
||||
return false
|
||||
}
|
||||
|
||||
// Login is not needed for cryptographic auth since authentication is cryptographic
|
||||
func (c *CryptoProvider) Login(_ context.Context) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// exchangeTokenForRegistry exchanges signature for a registry JWT token
|
||||
func (c *CryptoProvider) exchangeTokenForRegistry(ctx context.Context, domain, timestamp, signedTimestamp string) (string, error) {
|
||||
if c.registryURL == "" {
|
||||
return "", fmt.Errorf("registry URL is required for token exchange")
|
||||
}
|
||||
|
||||
// Prepare the request body
|
||||
payload := map[string]string{
|
||||
"domain": domain,
|
||||
"timestamp": timestamp,
|
||||
"signed_timestamp": signedTimestamp,
|
||||
}
|
||||
|
||||
jsonData, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to marshal request: %w", err)
|
||||
}
|
||||
|
||||
// Make the token exchange request
|
||||
exchangeURL := fmt.Sprintf("%s/v0/auth/%s", c.registryURL, c.authMethod)
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, exchangeURL, bytes.NewBuffer(jsonData))
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to create request: %w", err)
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.Header.Set("Accept", "application/json")
|
||||
|
||||
client := &http.Client{}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to send request: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to read response: %w", err)
|
||||
}
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return "", fmt.Errorf("token exchange failed with status %d: %s", resp.StatusCode, body)
|
||||
}
|
||||
|
||||
var tokenResp RegistryTokenResponse
|
||||
err = json.Unmarshal(body, &tokenResp)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to unmarshal response: %w", err)
|
||||
}
|
||||
|
||||
return tokenResp.RegistryToken, nil
|
||||
}
|
||||
|
|
@ -1,133 +1,24 @@
|
|||
package auth
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"time"
|
||||
)
|
||||
|
||||
type DNSProvider struct {
|
||||
registryURL string
|
||||
domain string
|
||||
hexSeed string
|
||||
*CryptoProvider
|
||||
}
|
||||
|
||||
// NewDNSProvider creates a new DNS-based auth provider
|
||||
//
|
||||
//nolint:ireturn
|
||||
func NewDNSProvider(registryURL, domain, hexSeed string) Provider {
|
||||
return &DNSProvider{
|
||||
registryURL: registryURL,
|
||||
domain: domain,
|
||||
hexSeed: hexSeed,
|
||||
CryptoProvider: &CryptoProvider{
|
||||
registryURL: registryURL,
|
||||
domain: domain,
|
||||
hexSeed: hexSeed,
|
||||
authMethod: "dns",
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// GetToken retrieves the registry JWT token using DNS authentication
|
||||
func (d *DNSProvider) GetToken(ctx context.Context) (string, error) {
|
||||
if d.domain == "" {
|
||||
return "", fmt.Errorf("DNS domain is required")
|
||||
}
|
||||
|
||||
if d.hexSeed == "" {
|
||||
return "", fmt.Errorf("DNS private key (hex seed) is required")
|
||||
}
|
||||
|
||||
// Decode hex seed to private key
|
||||
seedBytes, err := hex.DecodeString(d.hexSeed)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("invalid hex seed format: %w", err)
|
||||
}
|
||||
|
||||
if len(seedBytes) != ed25519.SeedSize {
|
||||
return "", fmt.Errorf("invalid seed length: expected %d bytes, got %d", ed25519.SeedSize, len(seedBytes))
|
||||
}
|
||||
|
||||
privateKey := ed25519.NewKeyFromSeed(seedBytes)
|
||||
|
||||
// Generate current timestamp
|
||||
timestamp := time.Now().UTC().Format(time.RFC3339)
|
||||
|
||||
// Sign the timestamp
|
||||
signature := ed25519.Sign(privateKey, []byte(timestamp))
|
||||
signedTimestamp := hex.EncodeToString(signature)
|
||||
|
||||
// Exchange signature for registry token
|
||||
registryToken, err := d.exchangeDNSTokenForRegistry(ctx, d.domain, timestamp, signedTimestamp)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to exchange DNS signature: %w", err)
|
||||
}
|
||||
|
||||
return registryToken, nil
|
||||
}
|
||||
|
||||
// NeedsLogin always returns false for DNS since no interactive login is needed
|
||||
func (d *DNSProvider) NeedsLogin() bool {
|
||||
return false
|
||||
}
|
||||
|
||||
// Login is not needed for DNS since authentication is cryptographic
|
||||
func (d *DNSProvider) Login(_ context.Context) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Name returns the name of this auth provider
|
||||
func (d *DNSProvider) Name() string {
|
||||
return "dns"
|
||||
}
|
||||
|
||||
// exchangeDNSTokenForRegistry exchanges DNS signature for a registry JWT token
|
||||
func (d *DNSProvider) exchangeDNSTokenForRegistry(ctx context.Context, domain, timestamp, signedTimestamp string) (string, error) {
|
||||
if d.registryURL == "" {
|
||||
return "", fmt.Errorf("registry URL is required for token exchange")
|
||||
}
|
||||
|
||||
// Prepare the request body
|
||||
payload := map[string]string{
|
||||
"domain": domain,
|
||||
"timestamp": timestamp,
|
||||
"signed_timestamp": signedTimestamp,
|
||||
}
|
||||
|
||||
jsonData, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to marshal request: %w", err)
|
||||
}
|
||||
|
||||
// Make the token exchange request
|
||||
exchangeURL := d.registryURL + "/v0/auth/dns"
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, exchangeURL, bytes.NewBuffer(jsonData))
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to create request: %w", err)
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.Header.Set("Accept", "application/json")
|
||||
|
||||
client := &http.Client{}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to send request: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to read response: %w", err)
|
||||
}
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return "", fmt.Errorf("token exchange failed with status %d: %s", resp.StatusCode, body)
|
||||
}
|
||||
|
||||
var tokenResp RegistryTokenResponse
|
||||
err = json.Unmarshal(body, &tokenResp)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to unmarshal response: %w", err)
|
||||
}
|
||||
|
||||
return tokenResp.RegistryToken, nil
|
||||
}
|
||||
|
|
|
|||
24
tools/publisher/auth/http.go
Normal file
24
tools/publisher/auth/http.go
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
package auth
|
||||
|
||||
type HTTPProvider struct {
|
||||
*CryptoProvider
|
||||
}
|
||||
|
||||
// NewHTTPProvider creates a new HTTP-based auth provider
|
||||
//
|
||||
//nolint:ireturn
|
||||
func NewHTTPProvider(registryURL, domain, hexSeed string) Provider {
|
||||
return &HTTPProvider{
|
||||
CryptoProvider: &CryptoProvider{
|
||||
registryURL: registryURL,
|
||||
domain: domain,
|
||||
hexSeed: hexSeed,
|
||||
authMethod: "http",
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// Name returns the name of this auth provider
|
||||
func (h *HTTPProvider) Name() string {
|
||||
return "http"
|
||||
}
|
||||
Loading…
Reference in a new issue