ee910ca286Add HTTP-based authentication to prove domain ownership, similar to https://github.com/modelcontextprotocol/registry/pull/238's DNS authentication but using HTTPS well-known URIs instead of DNS TXT records. Fixes #280 ## Motivation and Context Some organizations don't have easy access to DNS records, but can easily deploy web assets. They would therefore prefer to be able to complete a HTTP challenge rather than a DNS one to authenticate to the registry. This would in some way mirror ACME challenges: where you can do a DNS-01 or a HTTP-01 challenge. ## How Has This Been Tested? - Tested locally by stubbing out the HTTP getter - Added unit tests ## Breaking Changes None ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply. --> - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context I concern I had when building this that it might expose us to SSRF attacks. I think on reflection this is not a significant problem: - We only GET a fixed file `.well-known/mcp-registry-auth` (redirects disallowed) after sanitizing the domain, and then also don't expose the response to the user. This means the user shouldn't be able to hit anything very interesting. - The information they might get is what domains/servers exist in the network. Our infrastructure is already all open-source, so attackers aren't getting any additional real info by prodding at the environment this way.
24 lines
No EOL
481 B
Go
24 lines
No EOL
481 B
Go
package auth
|
|
|
|
type HTTPProvider struct {
|
|
*CryptoProvider
|
|
}
|
|
|
|
// NewHTTPProvider creates a new HTTP-based auth provider
|
|
//
|
|
//nolint:ireturn
|
|
func NewHTTPProvider(registryURL, domain, hexSeed string) Provider {
|
|
return &HTTPProvider{
|
|
CryptoProvider: &CryptoProvider{
|
|
registryURL: registryURL,
|
|
domain: domain,
|
|
hexSeed: hexSeed,
|
|
authMethod: "http",
|
|
},
|
|
}
|
|
}
|
|
|
|
// Name returns the name of this auth provider
|
|
func (h *HTTPProvider) Name() string {
|
|
return "http"
|
|
} |