[Bug] [BanyanDB] MCP HTTP server rejects a lowercase "bearer" Authorization scheme

Abierto
  • ¿Algo no está bien?
#14,199 0 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@UchihaIthachi ya está trabajando en esto.

Desde el 6/11/2026.

  • #1462 de @UchihaIthachi — abierto

Evaluación

Este issue todavía no se ha evaluado.

Descripción

bug database
Search before asking
  • I had searched in the issues and found no similar issues.
Apache SkyWalking Component

BanyanDB (apache/skywalking-banyandb)

What happened

While looking at the MCP server after #14194, I tried HTTP mode with a token and noticed that Authorization: bearer <token> (lowercase) gets a 401 even when the token is right. Only the exact Bearer prefix works, because getAuthorizationToken in mcp/src/server/http.ts uses startsWith('Bearer ').

What you expected to happen

The auth scheme name is case-insensitive (RFC 9110 section 11.1, which RFC 6750 uses for Bearer), so bearer or BEARER with the right token should be accepted. Some HTTP clients and proxies send it in lowercase, and a 401 there is confusing because the token itself is correct.

How to reproduce

On main (27349fdf), in mcp/ (BanyanDB doesn't need to be running for this):

TRANSPORT=http MCP_AUTH_TOKEN=secret MCP_PORT=3999 npx tsx src/index.ts &
curl -s -o /dev/null -w '%{http_code}\n' -X POST http://127.0.0.1:3999/mcp \
  -H 'Authorization: bearer secret' -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"ping"}'
# 401
curl -s -o /dev/null -w '%{http_code}\n' -X POST http://127.0.0.1:3999/mcp \
  -H 'Authorization: Bearer secret' -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"ping"}'
# 200
Anything else

Canopy in the same repo already handles this: bearerCredential in canopy/server/src/lib/tokens.ts matches the scheme case-insensitively. So the fix is to do the same in the MCP server, with unit tests for the header parsing. I have it ready and will link the PR here.

Are you willing to submit a pull request to fix on your own?
  • Yes I am willing to submit a pull request on my own!
Code of Conduct
Lenguaje dominante
Java
Estrellas
25k
Forks
6.6k
Merge medio
12 h 41 min
PR fusionados (30 d)
48

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/skywalking

Todos los issues de apache/skywalking

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.