feat: implement RFC 6750 Bearer token authentication #18644
Merged
+784
−7
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Jun 27, 2025
This was referenced Jun 27, 2025
ff83df4 to
3665807
Compare
5898895 to
5be6c6a
Compare
3665807 to
56126dd
Compare
5be6c6a to
fded148
Compare
fca6b9a to
68baa21
Compare
68baa21 to
578e708
Compare
9b7f5d9 to
7ef25b1
Compare
578e708 to
26c0eeb
Compare
7ef25b1 to
f0608bc
Compare
26c0eeb to
7b70f7f
Compare
f0608bc to
c68a923
Compare
7b70f7f to
1a9400e
Compare
c68a923 to
f55771a
Compare
5f946b1 to
14d91ac
Compare
f55771a to
34af681
Compare
a239eaa to
4ca3595
Compare
dd8ddee to
54580fa
Compare
4ca3595 to
23374cd
Compare
54580fa to
21cdd55
Compare
43fcceb to
db5e215
Compare
21cdd55 to
2410fd8
Compare
db5e215 to
953036f
Compare
2410fd8 to
7eb343b
Compare
7eb343b to
3760dd0
Compare
22c2dc6 to
14e6e22
Compare
3760dd0 to
2a41a65
Compare
14e6e22 to
5791cb0
Compare
2a41a65 to
52c88e0
Compare
7e0ce8a to
59b7a9d
Compare
52c88e0 to
4799b4b
Compare
4799b4b to
a07ba99
Compare
59b7a9d to
33bbf18
Compare
- Add RFC 6750 bearer token extraction to APITokenFromRequest as fallback methods - Support Authorization: Bearer <token> header and access_token query parameter - Maintain backward compatibility by prioritizing existing custom methods first - Add WWW-Authenticate headers to 401/403 responses per RFC 6750 - Update Protected Resource Metadata to advertise bearer_methods_supported - Add comprehensive test suite for RFC 6750 compliance in rfc6750_test.go - Update MCP test scripts with bearer token authentication tests - Enhance CLAUDE.md with improved Go LSP tool usage guidelines Implements RFC 6750 Section 2.1 (Authorization Request Header Field) and 2.3 (URI Query Parameter). Maintains full backward compatibility with existing Coder authentication methods. Completes major MCP OAuth2 compliance milestone. Change-Id: Ic9c9057153b40728ad91b377d753a7ffd566add7 Signed-off-by: Thomas Kosiewski <tk@coder.com>
a07ba99 to
5c1b9f6
Compare
Merge activity
|
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add RFC 6750 Bearer Token Authentication Support
This PR implements RFC 6750 Bearer Token authentication as an additional authentication method for Coder's API. This allows clients to authenticate using standard OAuth 2.0 Bearer tokens in two ways:
Authorization: Bearer <token>headeraccess_tokenquery parameterKey changes:
These authentication methods are added as fallback options, maintaining backward compatibility with Coder's existing authentication mechanisms. The existing authentication methods (cookies, session token header, etc.) still take precedence.
This implementation follows the OAuth 2.0 Bearer Token specification (RFC 6750) and improves interoperability with standard OAuth 2.0 clients.