Class: Msf::MCP::Middleware::BearerAuth

Inherits:
Object
  • Object
show all
Defined in:
lib/msf/core/mcp/middleware/bearer_auth.rb

Overview

Rack middleware that enforces Bearer token authentication on every request.

Skipped (pass-through) when no token is configured – the token is always present when this middleware is mounted because Server#start_http only adds it to the stack when auth_token is non-nil.

Clients must send:

Authorization: Bearer <token>

Returns 401 with a WWW-Authenticate challenge on any mismatch. Comparison is constant-time via Rack::Utils.secure_compare to prevent timing-based token enumeration.

Constant Summary collapse

UNAUTHORIZED = 
[
  401,
  {
    'Content-Type'    => 'application/json',
    'WWW-Authenticate' => 'Bearer realm="msfmcp"'
  },
  ['{"error":"Unauthorized"}']
].freeze

Instance Method Summary collapse

Constructor Details

#initialize(app, auth_token:) ⇒ BearerAuth

Returns a new instance of BearerAuth.



29
30
31
32
 
# File 'lib/msf/core/mcp/middleware/bearer_auth.rb', line 29

def initialize(app, auth_token:)
  @app        = app
  @auth_token = auth_token
end

Instance Method Details

#call(env) ⇒ Object 



34
35
36
37
38
39
40
 
# File 'lib/msf/core/mcp/middleware/bearer_auth.rb', line 34

def call(env)
  expected = "Bearer #{@auth_token}"
  provided = env['HTTP_AUTHORIZATION'].to_s
  return UNAUTHORIZED unless Rack::Utils.secure_compare(expected, provided)

  @app.call(env)
end