Warn when sensitive credentials are forwarded to upstream API

[DaleSeo]

When users configure forward_headers with sensitive credential headers like Authorization, Cookie, Proxy-Authorization, or X-Api-Key, the server now logs a warning at runtime when those headers are actually forwarded to the upstream GraphQL API. This helps operators catch unintentional credential exposure without blocking the request.

Per MCP security best practices, forwarding credentials can introduce audience confusion and privilege escalation risks.

Testing

1. Create a config file with a sensitive header in forward_headers:

endpoint: https://thespacedevs-production.up.railway.app/

forward_headers:
  - authorization
  - x-tenant-id

operations:
  source: local
  paths:
    - graphql/TheSpaceDevs/operations

schema:
  source: local
  path: graphql/TheSpaceDevs/api.graphql

introspection:
  execute:
    enabled: true

transport:
  type: streamable_http
  stateful_mode: false

2. Start the server and send a request that includes the Authorization header.

curl -X POST http://localhost:8000/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer test-token" \
  -H "X-Tenant-Id: tenant-123" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"GetAstronautsCurrentlyInSpace","arguments":{}}}'

3. Confirm the server logs a warning like:

2026-02-10T15:16:21.994684Z  WARN mcp_server{method=POST uri=/mcp status_code=200 OK}:call_tool{apollo.mcp.tool_name="GetAstronautsCurrentlyInSpace" apollo.mcp.request_id=2}: Forwarding sensitive header to upstream GraphQL API header=authorization

4. Confirm that x-tenant-id does not produce a warning.

[apollo-librarian]

✅ Docs preview ready

The preview is ready to be viewed. View the preview

File Changes

0 new, 2 changed, 0 removed

* (developer-tools)/apollo-mcp-server/(latest)/auth.mdx
* (developer-tools)/apollo-mcp-server/(latest)/config-file.mdx

Build ID: 6fd70c556b3081b49e797c30
Build Logs: View logs

URL: https://www.apollographql.com/docs/deploy-preview/6fd70c556b3081b49e797c30

[github-actions]

✅ Changeset file added - thank you!

[claude]

[Consider] The sensitive header check is case-sensitive, but HTTP header names are case-insensitive per RFC 7230. While this works correctly because reqwest normalizes header names to lowercase internally, consider using header_name.as_str().to_lowercase() to make the case-insensitivity explicit (similar to the hop-by-hop header check at line 48). This improves clarity about the behavior.

Reference: Chapter 1 (clear code beats comments)

[claude]

[Consider] For consistency with Chapter 5.1 recommendations, consider organizing this test within a mod forward_headers block alongside the other forward_headers tests (lines 244-315). This would make the test output read as forward_headers::warns_on_sensitive_headers and group related tests together.

Reference: Chapter 5.1 - Use modules for organization

[claude]

Review Summary

This PR adds runtime warnings when sensitive credential headers (authorization, cookie, proxy-authorization, x-api-key) are forwarded to the upstream GraphQL API, helping operators identify potential security risks per MCP security best practices.

The implementation is clean, focused, and well-tested. The warning is emitted only when the sensitive header is actually present in an incoming request, which is the right approach to avoid noise.

Findings

• Case sensitivity consideration: The sensitive header matching is case-sensitive. While this works correctly due to reqwest's header normalization, making it explicitly case-insensitive would improve clarity and robustness.
• Test organization: The new test could be grouped with other forward_headers tests in a module for better organization.

Test Coverage Assessment

✅ Excellent test coverage:

• Sensitive header warning is tested with multiple header types
• Verification that non-sensitive headers don't trigger warnings
• Integration with existing header forwarding tests

Final Recommendation

Approve with suggestions - The implementation is solid and ready to merge. The suggestions above are minor improvements for clarity and organization, not blocking issues.

---

Reviewed by Claude Code Sonnet 4.5

[pragl]

Docs changes LGTM!