|
| 1 | +use std::ops::Deref; |
| 2 | +use std::str::FromStr; |
| 3 | + |
| 4 | +use headers::HeaderMapExt; |
| 5 | +use http::Extensions; |
| 6 | +use reqwest::header::{HeaderMap, HeaderName}; |
| 7 | + |
| 8 | +use crate::auth::ValidToken; |
| 9 | + |
| 10 | +/// List of header names to forward from MCP clients to GraphQL API |
| 11 | +pub type ForwardHeaders = Vec<String>; |
| 12 | + |
| 13 | +/// Build headers for a GraphQL request by combining static headers with forwarded headers |
| 14 | +pub fn build_request_headers( |
| 15 | + static_headers: &HeaderMap, |
| 16 | + forward_header_names: &ForwardHeaders, |
| 17 | + incoming_headers: &HeaderMap, |
| 18 | + extensions: &Extensions, |
| 19 | + disable_auth_token_passthrough: bool, |
| 20 | +) -> HeaderMap { |
| 21 | + // Starts with static headers |
| 22 | + let mut headers = static_headers.clone(); |
| 23 | + |
| 24 | + // Forward headers dynamically |
| 25 | + forward_headers(forward_header_names, incoming_headers, &mut headers); |
| 26 | + |
| 27 | + // Optionally extract the validated token and propagate it to upstream servers if present |
| 28 | + if !disable_auth_token_passthrough && let Some(token) = extensions.get::<ValidToken>() { |
| 29 | + headers.typed_insert(token.deref().clone()); |
| 30 | + } |
| 31 | + |
| 32 | + // Forward the mcp-session-id header if present |
| 33 | + if let Some(session_id) = incoming_headers.get("mcp-session-id") { |
| 34 | + headers.insert("mcp-session-id", session_id.clone()); |
| 35 | + } |
| 36 | + |
| 37 | + headers |
| 38 | +} |
| 39 | + |
| 40 | +/// Forward matching headers from incoming headers to outgoing headers |
| 41 | +fn forward_headers(names: &[String], incoming: &HeaderMap, outgoing: &mut HeaderMap) { |
| 42 | + for header in names { |
| 43 | + if let Ok(header_name) = HeaderName::from_str(header) |
| 44 | + && let Some(value) = incoming.get(&header_name) |
| 45 | + // Hop-by-hop headers are blocked per RFC 7230: https://datatracker.ietf.org/doc/html/rfc7230#section-6.1 |
| 46 | + && !matches!( |
| 47 | + header_name.as_str().to_lowercase().as_str(), |
| 48 | + "connection" |
| 49 | + | "keep-alive" |
| 50 | + | "proxy-authenticate" |
| 51 | + | "proxy-authorization" |
| 52 | + | "te" |
| 53 | + | "trailers" |
| 54 | + | "transfer-encoding" |
| 55 | + | "upgrade" |
| 56 | + | "content-length" |
| 57 | + ) |
| 58 | + { |
| 59 | + outgoing.insert(header_name, value.clone()); |
| 60 | + } |
| 61 | + } |
| 62 | +} |
| 63 | + |
| 64 | +#[cfg(test)] |
| 65 | +mod tests { |
| 66 | + use super::*; |
| 67 | + use reqwest::header::HeaderValue; |
| 68 | + |
| 69 | + #[test] |
| 70 | + fn test_forward_no_headers_by_default() { |
| 71 | + let names: Vec<String> = vec![]; |
| 72 | + |
| 73 | + let mut incoming = HeaderMap::new(); |
| 74 | + incoming.insert("x-tenant-id", HeaderValue::from_static("tenant-123")); |
| 75 | + |
| 76 | + let mut outgoing = HeaderMap::new(); |
| 77 | + |
| 78 | + forward_headers(&names, &incoming, &mut outgoing); |
| 79 | + |
| 80 | + assert!(outgoing.is_empty()); |
| 81 | + } |
| 82 | + |
| 83 | + #[test] |
| 84 | + fn test_forward_only_allowed_headers() { |
| 85 | + let names = vec![ |
| 86 | + "x-tenant-id".to_string(), // Multi-tenancy |
| 87 | + "x-trace-id".to_string(), // Distributed tracing |
| 88 | + "x-geo-country".to_string(), // Geo information from CDN |
| 89 | + "x-experiment-id".to_string(), // A/B testing |
| 90 | + "ai-client-name".to_string(), // Client identification |
| 91 | + ]; |
| 92 | + |
| 93 | + let mut incoming = HeaderMap::new(); |
| 94 | + incoming.insert("x-tenant-id", HeaderValue::from_static("tenant-123")); |
| 95 | + incoming.insert("x-trace-id", HeaderValue::from_static("trace-456")); |
| 96 | + incoming.insert("x-geo-country", HeaderValue::from_static("US")); |
| 97 | + incoming.insert("x-experiment-id", HeaderValue::from_static("exp-789")); |
| 98 | + incoming.insert("ai-client-name", HeaderValue::from_static("claude")); |
| 99 | + incoming.insert("other-header", HeaderValue::from_static("ignored")); |
| 100 | + |
| 101 | + let mut outgoing = HeaderMap::new(); |
| 102 | + |
| 103 | + forward_headers(&names, &incoming, &mut outgoing); |
| 104 | + |
| 105 | + assert_eq!(outgoing.get("x-tenant-id").unwrap(), "tenant-123"); |
| 106 | + assert_eq!(outgoing.get("x-trace-id").unwrap(), "trace-456"); |
| 107 | + assert_eq!(outgoing.get("x-geo-country").unwrap(), "US"); |
| 108 | + assert_eq!(outgoing.get("x-experiment-id").unwrap(), "exp-789"); |
| 109 | + assert_eq!(outgoing.get("ai-client-name").unwrap(), "claude"); |
| 110 | + |
| 111 | + assert!(outgoing.get("other-header").is_none()); |
| 112 | + } |
| 113 | + |
| 114 | + #[test] |
| 115 | + fn test_hop_by_hop_headers_blocked() { |
| 116 | + let names = vec!["connection".to_string(), "content-length".to_string()]; |
| 117 | + |
| 118 | + let mut incoming = HeaderMap::new(); |
| 119 | + incoming.insert("connection", HeaderValue::from_static("keep-alive")); |
| 120 | + incoming.insert("content-length", HeaderValue::from_static("1234")); |
| 121 | + |
| 122 | + let mut outgoing = HeaderMap::new(); |
| 123 | + |
| 124 | + forward_headers(&names, &incoming, &mut outgoing); |
| 125 | + |
| 126 | + assert!(outgoing.get("connection").is_none()); |
| 127 | + assert!(outgoing.get("content-length").is_none()); |
| 128 | + } |
| 129 | + |
| 130 | + #[test] |
| 131 | + fn test_case_insensitive_matching() { |
| 132 | + let names = vec!["X-Tenant-ID".to_string()]; |
| 133 | + |
| 134 | + let mut incoming = HeaderMap::new(); |
| 135 | + incoming.insert("x-tenant-id", HeaderValue::from_static("tenant-123")); |
| 136 | + |
| 137 | + let mut outgoing = HeaderMap::new(); |
| 138 | + forward_headers(&names, &incoming, &mut outgoing); |
| 139 | + |
| 140 | + assert_eq!(outgoing.get("x-tenant-id").unwrap(), "tenant-123"); |
| 141 | + } |
| 142 | +} |
0 commit comments