feat: implement RFC 6750 Bearer token authentication #18644
+784
−7
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Jun 27, 2025
This was referenced Jun 27, 2025
ff83df4 to
3665807
Compare
5898895 to
5be6c6a
Compare
3665807 to
56126dd
Compare
5be6c6a to
fded148
Compare
fca6b9a to
68baa21
Compare
68baa21 to
578e708
Compare
9b7f5d9 to
7ef25b1
Compare
578e708 to
26c0eeb
Compare
7ef25b1 to
f0608bc
Compare
26c0eeb to
7b70f7f
Compare
f0608bc to
c68a923
Compare
7b70f7f to
1a9400e
Compare
c68a923 to
f55771a
Compare
5f946b1 to
14d91ac
Compare
f55771a to
34af681
Compare
0f4491b to
8c975b5
Compare
1a99f3c to
01a10ef
Compare
8c975b5 to
017f23f
Compare
johnstcn
reviewed
Jul 1, 2025
johnstcn
reviewed
Jul 1, 2025
There was a problem hiding this comment.
What's the significance of extended versus the regular test?
There was a problem hiding this comment.
The idea was that rfc6750_test.go contain basic RFC 6750 compliance tests (authentication methods, basic token validation), while the rfc6750_extended_test.go contain security and edge case testing (malformed headers, precedence, WWW-Authenticate compliance, etc.).
017f23f to
77e3e55
Compare
01a10ef to
3b6d8ba
Compare
77e3e55 to
1e1e046
Compare
3b6d8ba to
dac326d
Compare
1e1e046 to
17982a7
Compare
dac326d to
1858134
Compare
17982a7 to
119626d
Compare
johnstcn
approved these changes
Jul 1, 2025
Emyrk
approved these changes
Jul 1, 2025
Comment on lines
+225
to
+228
| case strings.Contains(response.Message, "expired") || strings.Contains(response.Detail, "expired"): | ||
| wwwAuth = `Bearer realm="coder", error="invalid_token", error_description="The access token has expired"` | ||
| case strings.Contains(response.Message, "audience") || strings.Contains(response.Message, "mismatch"): | ||
| wwwAuth = `Bearer realm="coder", error="invalid_token", error_description="The access token audience does not match this resource"` |
There was a problem hiding this comment.
Very unfortunate we have to do string matches 😢
There was a problem hiding this comment.
Pull Request Overview
This PR implements RFC 6750 Bearer Token authentication as a fallback method, adds corresponding tests, and updates metadata to advertise Bearer support.
- Added shell tests for header/query parameter authentication and metadata endpoint in
test-mcp-oauth2.sh - Updated Go metadata endpoint and its tests to include
BearerMethodsSupported - Extended middleware (
apikey.go) to extract Bearer tokens and set properWWW-Authenticateheaders
Reviewed Changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| scripts/oauth2/test-mcp-oauth2.sh | Add tests for Bearer header, query parameter, and metadata |
| coderd/oauth2_metadata_test.go | Update protected-resource metadata tests to expect Bearer methods |
| coderd/oauth2.go | Enable BearerMethodsSupported in the metadata response |
| coderd/httpmw/rfc6750_test.go | Add unit tests for basic RFC 6750 header/query extraction |
| coderd/httpmw/rfc6750_extended_test.go | Expand security, precedence, and compliance tests for RFC 6750 |
| coderd/httpmw/apikey.go | Implement Bearer token extraction and WWW-Authenticate headers |
Comments suppressed due to low confidence (2)
scripts/oauth2/test-mcp-oauth2.sh:210
- The test references RFC 9728 but the OAuth 2.0 protected resource metadata spec is RFC 9126. Update the reference for accuracy.
echo -e "${YELLOW}Test 7: Protected Resource Metadata (RFC 9728)${NC}"
scripts/oauth2/test-mcp-oauth2.sh:200
- Add a complementary test for 403 Forbidden responses to verify the
insufficient_scopeWWW-Authenticateheader is set correctly.
# Test WWW-Authenticate header on unauthorized request
1858134 to
a239eaa
Compare
6487981 to
b612336
Compare
a239eaa to
4ca3595
Compare
dd8ddee to
54580fa
Compare
4ca3595 to
23374cd
Compare
54580fa to
21cdd55
Compare
23374cd to
43fcceb
Compare
- Add RFC 6750 bearer token extraction to APITokenFromRequest as fallback methods - Support Authorization: Bearer <token> header and access_token query parameter - Maintain backward compatibility by prioritizing existing custom methods first - Add WWW-Authenticate headers to 401/403 responses per RFC 6750 - Update Protected Resource Metadata to advertise bearer_methods_supported - Add comprehensive test suite for RFC 6750 compliance in rfc6750_test.go - Update MCP test scripts with bearer token authentication tests - Enhance CLAUDE.md with improved Go LSP tool usage guidelines Implements RFC 6750 Section 2.1 (Authorization Request Header Field) and 2.3 (URI Query Parameter). Maintains full backward compatibility with existing Coder authentication methods. Completes major MCP OAuth2 compliance milestone. Change-Id: Ic9c9057153b40728ad91b377d753a7ffd566add7 Signed-off-by: Thomas Kosiewski <[email protected]>
43fcceb to
db5e215
Compare
21cdd55 to
2410fd8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add RFC 6750 Bearer Token Authentication Support
This PR implements RFC 6750 Bearer Token authentication as an additional authentication method for Coder's API. This allows clients to authenticate using standard OAuth 2.0 Bearer tokens in two ways:
Authorization: Bearer <token>headeraccess_tokenquery parameterKey changes:
These authentication methods are added as fallback options, maintaining backward compatibility with Coder's existing authentication mechanisms. The existing authentication methods (cookies, session token header, etc.) still take precedence.
This implementation follows the OAuth 2.0 Bearer Token specification (RFC 6750) and improves interoperability with standard OAuth 2.0 clients.