Non-ASCII bearer token returns 500 instead of 401
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 90/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- python
- Domain
- authentication
Research direction
Start in kubeflow_mcp/core/auth.py at APIKeyVerifier.verify_token, especially line 64, and inspect the existing authentication tests in auth_test.py. Reproduce verification with a non-ASCII bearer token and confirm the completed change returns HTTP 401 with invalid_token rather than 500, while preserving the wrong ASCII token behavior.
Written by the indexing model from the issue text.
Description
Description
APIKeyVerifier.verify_token compares two str values with hmac.compare_digest (kubeflow_mcp/core/auth.py L64). Python raises TypeError when either string has non-ASCII characters, so the request fails with 500 instead of being rejected.
Steps to Reproduce
kubeflow-mcp serve --transport http --auth-token s3cret- POST an
initializerequest to/mcpwith headerAuthorization: Bearer café(UTF-8) - See 500
Expected Behavior
401 with invalid_token, same as a wrong ASCII token.
Actual Behavior
500 Internal Server Error. Log ends with:
TypeError: comparing strings with non-ASCII characters is not supported
(from auth.py line 64, in verify_token)
MCP Server Version
0.1.1 (main at 0f90ca6)
Python Version
3.12
Kubernetes Version
n/a
MCP Client
Custom / Other
References
MCP authorization spec, invalid or expired tokens get HTTP 401. Fix is to compare bytes, hmac.compare_digest(token.encode(), self._expected.encode()), plus a test in auth_test.py.
- Dominant language
- Python
- Stars
- 44
- Forks
- 54
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 31
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from kubeflow/mcp-server
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
kubeflow/mcp-server#273 ·
-
kind/bug needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
kubeflow/mcp-server#267 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
kubeflow/mcp-server#260 · 1 comment ·
-
kind/bug needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
kubeflow/mcp-server#247 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
kubeflow/mcp-server#232 ·
All issues in kubeflow/mcp-server
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100