feat(auth): add token revocation and proxy auth to middleware by crivetimihai · Pull Request #2548 · IBM/mcp-context-forge

crivetimihai · 2026-01-28T17:06:52Z

Summary

Comprehensive authentication and authorization improvements across the gateway. Closes #2555

Changes

Admin Middleware & Token Handling

Add token revocation checks in AdminAuthMiddleware
Add proxy authentication support for admin routes (TRUST_PROXY_AUTH, PROXY_USER_HEADER)
Add account status validation (reject disabled accounts)
Add admin privilege verification for protected routes

Session Management

Server-side session ID generation (client-supplied IDs ignored)
Session listings filtered by user ownership (admins see all, users see own)
Session ownership tracking and validation

SSO & OAuth

Add redirect URL validation for SSO flows
Add team membership validation for OAuth operations
Add configurable public registration setting (ALLOW_PUBLIC_REGISTRATION)
Validate redirect URIs against allowed patterns

API Authentication

Add API_ALLOW_BASIC_AUTH setting (default: false) for granular control
Basic auth disabled by default for API endpoints
Admin UI uses session-based email/password authentication

Token Validation Defaults

REQUIRE_TOKEN_EXPIRATION default changed to true
REQUIRE_JTI default changed to true
Tokens must include expiration and JWT ID claims by default

Gateway Credentials

Gateway service credentials scoped to local authentication
Credentials not forwarded to remote MCP servers

Documentation (25+ files)

Expand securing guide with token lifecycle and access controls
Update ADR-004 with API_ALLOW_BASIC_AUTH rationale
Clarify Admin UI vs API authentication model
Fix default values in configuration tables
Remove unused BASIC_AUTH_* from Docker examples
Update all tutorials and deployment guides

Configuration

Add settings to .env.example and config schemas
Update Helm chart values and schema
Update docker-compose.yml with current defaults

Tests

Add reverse proxy session management tests
Add OAuth router team validation tests
Add require_admin_auth() tests for Basic auth gating
Add CLI get_auth_token() tests
Fix timing in cache TTL test

Files Changed

51 files changed, 1356 insertions(+), 261 deletions(-)

Test Plan

Admin UI login with email/password works
API rejects Basic auth by default
API accepts Basic auth when API_ALLOW_BASIC_AUTH=true
Token revocation blocks access
Session filtering works (admin vs user)
SSO redirect validation works
Full test suite passes

brian-hussey

I'm seeing issues with functionality.
Token is not getting revoked after given time - maybe my time limit was too aggressive?

TOKEN_EXPIRY=3
REQUIRE_TOKEN_EXPIRATION=true
REQUIRE_JTI=true

I'm not getting access denied after timeout period is reached.
But I am getting logged out of my browser session.

For registration, the message coming back with PUBLIC_REGISTRATION_ENABLED=false set is always:

{
  "detail": "User with email fake@email.com already exists"
}

(I'm passing in fake email) - should it default to that message or just give a generic access_denied/403 response?

- Support token revocation checks in AdminAuthMiddleware - Enable proxy authentication for admin routes - Filter session listings by user ownership - Validate team membership for OAuth operations - Add configurable public registration setting Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

- Set require_token_expiration default to true (was false) - Set require_jti default to true (was false) - Update .env.example to reflect new secure defaults Tokens without expiration or JTI claims will now be rejected by default. Set REQUIRE_TOKEN_EXPIRATION=false or REQUIRE_JTI=false to restore previous behavior if needed for backward compatibility. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

… controls Add documentation for: - Token lifecycle management (revocation, validation settings) - Admin route authentication requirements - Session management access controls - User registration configuration - Updated production checklist with new settings Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

- SSO redirect_uri validation now uses server-side allowlist only (allowed_origins, app_domain) instead of trusting Host header - Full origin comparison including scheme and port to prevent cross-port or HTTP downgrade redirects - AdminAuthMiddleware now supports API token authentication - AdminAuthMiddleware now honors platform admin bootstrap when REQUIRE_USER_IN_DB=false for fresh deployments Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

Align AdminAuthMiddleware with require_admin_auth by supporting: - HTTP Basic authentication for legacy deployments - Basic auth users are treated as admin (consistent with existing behavior) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

- Move hashlib/base64 imports to top-level in main.py (pylint C0415) - Add CHANGELOG entry for 1.0.0-RC1 secure defaults release - Add Security Defaults section to .env.example - Update test helpers to include JTI by default for REQUIRE_JTI=true Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

- Simplify Admin UI to use session-based email/password authentication - Add API_ALLOW_BASIC_AUTH setting for granular API auth control - Scope gateway credentials to prevent unintended forwarding - Update 25+ documentation files for auth model clarity - Add comprehensive test coverage for auth settings - Fix REQUIRE_TOKEN_EXPIRATION and REQUIRE_JTI defaults in docs - Remove BASIC_AUTH_* from Docker examples (not needed by default) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

- Reword RC1 changelog entries to use neutral language - Add coverage.svg to .gitignore (generated by make coverage) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* feat(auth): add token revocation and proxy auth to admin middleware - Support token revocation checks in AdminAuthMiddleware - Enable proxy authentication for admin routes - Filter session listings by user ownership - Validate team membership for OAuth operations - Add configurable public registration setting Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(config): change token validation defaults to secure-by-default - Set require_token_expiration default to true (was false) - Set require_jti default to true (was false) - Update .env.example to reflect new secure defaults Tokens without expiration or JTI claims will now be rejected by default. Set REQUIRE_TOKEN_EXPIRATION=false or REQUIRE_JTI=false to restore previous behavior if needed for backward compatibility. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * docs(security): expand securing guide with token lifecycle and access controls Add documentation for: - Token lifecycle management (revocation, validation settings) - Admin route authentication requirements - Session management access controls - User registration configuration - Updated production checklist with new settings Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(auth): address SSO redirect validation and admin middleware gaps - SSO redirect_uri validation now uses server-side allowlist only (allowed_origins, app_domain) instead of trusting Host header - Full origin comparison including scheme and port to prevent cross-port or HTTP downgrade redirects - AdminAuthMiddleware now supports API token authentication - AdminAuthMiddleware now honors platform admin bootstrap when REQUIRE_USER_IN_DB=false for fresh deployments Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(auth): add basic auth support to AdminAuthMiddleware Align AdminAuthMiddleware with require_admin_auth by supporting: - HTTP Basic authentication for legacy deployments - Basic auth users are treated as admin (consistent with existing behavior) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(auth): finalize secure defaults and update changelog for RC1 - Move hashlib/base64 imports to top-level in main.py (pylint C0415) - Add CHANGELOG entry for 1.0.0-RC1 secure defaults release - Add Security Defaults section to .env.example - Update test helpers to include JTI by default for REQUIRE_JTI=true Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * refactor(auth): streamline authentication model and update documentation - Simplify Admin UI to use session-based email/password authentication - Add API_ALLOW_BASIC_AUTH setting for granular API auth control - Scope gateway credentials to prevent unintended forwarding - Update 25+ documentation files for auth model clarity - Add comprehensive test coverage for auth settings - Fix REQUIRE_TOKEN_EXPIRATION and REQUIRE_JTI defaults in docs - Remove BASIC_AUTH_* from Docker examples (not needed by default) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * docs: update changelog with neutral language and ignore coverage.svg - Reword RC1 changelog entries to use neutral language - Add coverage.svg to .gitignore (generated by make coverage) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Signed-off-by: hughhennnelly <hughhennelly06@gmail.com>

* feat(auth): add token revocation and proxy auth to admin middleware - Support token revocation checks in AdminAuthMiddleware - Enable proxy authentication for admin routes - Filter session listings by user ownership - Validate team membership for OAuth operations - Add configurable public registration setting Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(config): change token validation defaults to secure-by-default - Set require_token_expiration default to true (was false) - Set require_jti default to true (was false) - Update .env.example to reflect new secure defaults Tokens without expiration or JTI claims will now be rejected by default. Set REQUIRE_TOKEN_EXPIRATION=false or REQUIRE_JTI=false to restore previous behavior if needed for backward compatibility. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * docs(security): expand securing guide with token lifecycle and access controls Add documentation for: - Token lifecycle management (revocation, validation settings) - Admin route authentication requirements - Session management access controls - User registration configuration - Updated production checklist with new settings Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(auth): address SSO redirect validation and admin middleware gaps - SSO redirect_uri validation now uses server-side allowlist only (allowed_origins, app_domain) instead of trusting Host header - Full origin comparison including scheme and port to prevent cross-port or HTTP downgrade redirects - AdminAuthMiddleware now supports API token authentication - AdminAuthMiddleware now honors platform admin bootstrap when REQUIRE_USER_IN_DB=false for fresh deployments Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(auth): add basic auth support to AdminAuthMiddleware Align AdminAuthMiddleware with require_admin_auth by supporting: - HTTP Basic authentication for legacy deployments - Basic auth users are treated as admin (consistent with existing behavior) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(auth): finalize secure defaults and update changelog for RC1 - Move hashlib/base64 imports to top-level in main.py (pylint C0415) - Add CHANGELOG entry for 1.0.0-RC1 secure defaults release - Add Security Defaults section to .env.example - Update test helpers to include JTI by default for REQUIRE_JTI=true Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * refactor(auth): streamline authentication model and update documentation - Simplify Admin UI to use session-based email/password authentication - Add API_ALLOW_BASIC_AUTH setting for granular API auth control - Scope gateway credentials to prevent unintended forwarding - Update 25+ documentation files for auth model clarity - Add comprehensive test coverage for auth settings - Fix REQUIRE_TOKEN_EXPIRATION and REQUIRE_JTI defaults in docs - Remove BASIC_AUTH_* from Docker examples (not needed by default) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * docs: update changelog with neutral language and ignore coverage.svg - Reword RC1 changelog entries to use neutral language - Add coverage.svg to .gitignore (generated by make coverage) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

crivetimihai requested review from brian-hussey, jonpspri and kevalmahajan January 28, 2026 17:07

crivetimihai force-pushed the rbac-issues branch from 112bd90 to 7dc102a Compare January 28, 2026 17:22

crivetimihai marked this pull request as ready for review January 28, 2026 17:33

crivetimihai requested a review from madhav165 as a code owner January 28, 2026 17:33

brian-hussey reviewed Jan 28, 2026

View reviewed changes

IBM deleted a comment from brian-hussey Jan 28, 2026

crivetimihai self-assigned this Jan 28, 2026

crivetimihai added security Improves security revisit Revisit this PR at a later date to address further issues, or if problems arise. labels Jan 28, 2026

crivetimihai added this to the Release 1.0.0-RC1 milestone Jan 28, 2026

crivetimihai added 7 commits January 28, 2026 23:38

crivetimihai force-pushed the rbac-issues branch from 968481b to 379ed76 Compare January 28, 2026 23:38

crivetimihai mentioned this pull request Jan 28, 2026

[EPIC][AUTH]: Streamlined Authentication Model & Secure Defaults #2555

Closed

20 tasks

docs: update changelog with neutral language and ignore coverage.svg

b2c950d

- Reword RC1 changelog entries to use neutral language - Add coverage.svg to .gitignore (generated by make coverage) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

crivetimihai force-pushed the rbac-issues branch from 379ed76 to b2c950d Compare January 28, 2026 23:46

crivetimihai merged commit a44ca2b into main Jan 29, 2026
53 checks passed

crivetimihai deleted the rbac-issues branch January 29, 2026 00:05

crivetimihai mentioned this pull request Jan 29, 2026

[EPIC][AUTH]: Authentication Rate Controls & Plugin Support #2556

Open

41 tasks

MohanLaksh mentioned this pull request Jan 29, 2026

[SECURITY][SONAR][MEDIUM]: Missing token validation in reverse_proxy WebSocket endpoint #2375

Closed

This was referenced Jan 31, 2026

[EPIC][SECURITY]: Enhance secure-by-default posture for secrets management #2595

Open

[BUG][AUTH]: UI/API Users with no admin privileges can no longer login #2590

Closed

madhav165 mentioned this pull request Feb 10, 2026

Fix admin login 302 redirect loop behind reverse proxies that forward the full request path #2807

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(auth): add token revocation and proxy auth to middleware#2548

feat(auth): add token revocation and proxy auth to middleware#2548
crivetimihai merged 8 commits intomainfrom
rbac-issues

crivetimihai commented Jan 28, 2026 •

edited

Loading

Uh oh!

brian-hussey left a comment •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

crivetimihai commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Admin Middleware & Token Handling

Session Management

SSO & OAuth

API Authentication

Token Validation Defaults

Gateway Credentials

Documentation (25+ files)

Configuration

Tests

Files Changed

Test Plan

Uh oh!

brian-hussey left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

crivetimihai commented Jan 28, 2026 •

edited

Loading

brian-hussey left a comment •

edited

Loading