ee910ca286Add HTTP-based authentication to prove domain ownership, similar to https://github.com/modelcontextprotocol/registry/pull/238's DNS authentication but using HTTPS well-known URIs instead of DNS TXT records. Fixes #280 ## Motivation and Context Some organizations don't have easy access to DNS records, but can easily deploy web assets. They would therefore prefer to be able to complete a HTTP challenge rather than a DNS one to authenticate to the registry. This would in some way mirror ACME challenges: where you can do a DNS-01 or a HTTP-01 challenge. ## How Has This Been Tested? - Tested locally by stubbing out the HTTP getter - Added unit tests ## Breaking Changes None ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply. --> - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context I concern I had when building this that it might expose us to SSRF attacks. I think on reflection this is not a significant problem: - We only GET a fixed file `.well-known/mcp-registry-auth` (redirects disallowed) after sanitizing the domain, and then also don't expose the response to the user. This means the user shouldn't be able to hit anything very interesting. - The information they might get is what domains/servers exist in the network. Our infrastructure is already all open-source, so attackers aren't getting any additional real info by prodding at the environment this way.
28 lines
795 B
Go
28 lines
795 B
Go
package auth
|
|
|
|
import (
|
|
"github.com/danielgtaylor/huma/v2"
|
|
"github.com/modelcontextprotocol/registry/internal/config"
|
|
)
|
|
|
|
// RegisterAuthEndpoints registers all authentication endpoints
|
|
func RegisterAuthEndpoints(api huma.API, cfg *config.Config) {
|
|
// Register GitHub access token authentication endpoint
|
|
RegisterGitHubATEndpoint(api, cfg)
|
|
|
|
// Register GitHub OIDC authentication endpoint
|
|
RegisterGitHubOIDCEndpoint(api, cfg)
|
|
|
|
// Register DNS-based authentication endpoint
|
|
RegisterDNSEndpoint(api, cfg)
|
|
|
|
// Register HTTP-based authentication endpoint
|
|
RegisterHTTPEndpoint(api, cfg)
|
|
|
|
// Register anonymous authentication endpoint
|
|
RegisterNoneEndpoint(api, cfg)
|
|
|
|
// Future auth providers can be registered here:
|
|
// RegisterGitLabEndpoint(api, cfg)
|
|
// RegisterOIDCEndpoint(api, cfg)
|
|
}
|