add proxy-friendly headers and address locking (#291)

* add proxy-friendly headers and address locking

* add Authorization Bearer header support

Author: jaylonmcshan19-x

CHANGELOG.md

@@ -5,7 +5,7 @@ FIXES
 * Fix sessions handling in stateless and load balanced environments
 
 IMPROVEMENTS
-
+* Add `Authorization: Bearer` header support for Terraform token in proxy environments
 * Add `--heartbeat-interval` CLI flag and `MCP_HEARTBEAT_INTERVAL` env var for HTTP heartbeat in load-balanced environments
 * Set custom User-Agent header for TFE API requests to enable tracking MCP server usage separately from other go-tfe clients [268](https://github.com/hashicorp/terraform-mcp-server/pull/268)
 * Adding a new cli flags `--log-level` to set the desired log level for the server logs and `--log-format` for the logs formatting [286](https://github.com/hashicorp/terraform-mcp-server/pull/286)

pkg/client/middleware.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 	"net/http"
-	"net/textproto"
 	"os"
 	"strings"
 
@@ -101,7 +100,7 @@ func (h *securityHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Access-Control-Max-Age", "3600")
 		w.Header().Set("Access-Control-Allow-Origin", origin)
 		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
-		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id")
+		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, Authorization")
 	}
 
 	// Handle OPTIONS requests for CORS preflight
@@ -125,6 +124,15 @@ func NewSecurityHandler(handler http.Handler, allowedOrigins []string, corsMode
 	}
 }
 
+// getTokenFromAuthHeader extracts token from Authorization Bearer header
+func getTokenFromAuthHeader(r *http.Request) string {
+	authHeader := r.Header.Get("Authorization")
+	if strings.HasPrefix(authHeader, "Bearer ") {
+		return strings.TrimPrefix(authHeader, "Bearer ")
+	}
+	return ""
+}
+
 // TerraformContextMiddleware adds Terraform-related header values to the request context
 // This middleware extracts Terraform configuration from HTTP headers, query parameters,
 // or environment variables and adds them to the request context for use by MCP tools
@@ -134,16 +142,22 @@ func TerraformContextMiddleware(logger *log.Logger) func(http.Handler) http.Hand
 			requiredHeaders := []string{TerraformAddress, TerraformToken, TerraformSkipTLSVerify}
 			ctx := r.Context()
 			for _, header := range requiredHeaders {
-				// Priority order: HTTP header -> Query parameter -> Environment variable
-				headerValue := r.Header.Get(textproto.CanonicalMIMEHeaderKey(header))
+				var headerValue string
+
+				// Check standard header first
+				headerValue = r.Header.Get(header)
+
+				// For token, also support Authorization: Bearer header as fallback
+				if headerValue == "" && header == TerraformToken {
+					headerValue = getTokenFromAuthHeader(r)
+				}
 
 				if headerValue == "" {
 					headerValue = r.URL.Query().Get(header)
 
-					// Explicitly disallow TerraformToken in query parameters for security reasons
 					if header == TerraformToken && headerValue != "" {
 						logger.Info(fmt.Sprintf("Terraform token was provided in query parameters by client %v, terminating request", r.RemoteAddr))
-						http.Error(w, "Terraform token should not be provided in query parameters for security reasons, use the terraform_token header", http.StatusBadRequest)
+						http.Error(w, "Terraform token should not be provided in query parameters for security reasons, use the Authorization header", http.StatusBadRequest)
 						return
 					}
 				}

pkg/client/middleware_test.go

@@ -315,6 +315,62 @@ func TestOptionsRequest(t *testing.T) {
 	assert.NotEmpty(t, rr.Header().Get("Access-Control-Allow-Methods"))
 }
 
+// TestGetTokenFromAuthHeader tests the helper function that extracts token from Authorization Bearer header
+func TestGetTokenFromAuthHeader(t *testing.T) {
+	tests := []struct {
+		name     string
+		headers  map[string]string
+		expected string
+	}{
+		{
+			name:     "Authorization Bearer token",
+			headers:  map[string]string{"Authorization": "Bearer my-token"},
+			expected: "my-token",
+		},
+		{
+			name:     "Authorization Basic ignored",
+			headers:  map[string]string{"Authorization": "Basic abc123"},
+			expected: "",
+		},
+		{
+			name:     "no Authorization header",
+			headers:  map[string]string{},
+			expected: "",
+		},
+		{
+			name:     "empty Authorization header",
+			headers:  map[string]string{"Authorization": ""},
+			expected: "",
+		},
+		{
+			name:     "Bearer with no token",
+			headers:  map[string]string{"Authorization": "Bearer "},
+			expected: "",
+		},
+		{
+			name:     "Bearer with whitespace token",
+			headers:  map[string]string{"Authorization": "Bearer   "},
+			expected: "  ",
+		},
+		{
+			name:     "Bearer lowercase",
+			headers:  map[string]string{"Authorization": "bearer my-token"},
+			expected: "", // Case sensitive - must be "Bearer"
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "/", nil)
+			for k, v := range tt.headers {
+				req.Header.Set(k, v)
+			}
+			result := getTokenFromAuthHeader(req)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
 // TestTerraformContextMiddleware tests the middleware that extracts Terraform configuration
 // from HTTP headers, query parameters, and environment variables and adds them to the request context
 func TestTerraformContextMiddleware(t *testing.T) {
@@ -369,6 +425,31 @@ func TestTerraformContextMiddleware(t *testing.T) {
 				TerraformSkipTLSVerify: "true",
 			},
 		},
+		{
+			name: "Authorization Bearer header provides token",
+			headers: map[string]string{
+				"Authorization": "Bearer bearer-token",
+			},
+			queryParams:    map[string]string{},
+			envVars:        map[string]string{},
+			expectedStatus: http.StatusOK,
+			expectedContextVals: map[string]string{
+				TerraformToken: "bearer-token",
+			},
+		},
+		{
+			name: "standard header takes priority over Authorization Bearer",
+			headers: map[string]string{
+				TerraformToken:  "standard-token",
+				"Authorization": "Bearer bearer-token",
+			},
+			queryParams:    map[string]string{},
+			envVars:        map[string]string{},
+			expectedStatus: http.StatusOK,
+			expectedContextVals: map[string]string{
+				TerraformToken: "standard-token",
+			},
+		},
 		{
 			name:    "query params take priority over env vars (except token)",
 			headers: map[string]string{},
@@ -428,7 +509,7 @@ func TestTerraformContextMiddleware(t *testing.T) {
 			envVars:        map[string]string{},
 			expectedStatus: http.StatusBadRequest,
 			expectError:    true,
-			errorMessage:   "Terraform token should not be provided in query parameters for security reasons, use the terraform_token header",
+			errorMessage:   "Terraform token should not be provided in query parameters",
 		},
 		{
 			name: "canonical header names are handled correctly",