bao/nexus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

P1a: Ensure ApiKeyMiddleware skips /mcp endpoint

Browse Source 
The MCP endpoint handles its own authentication via X-Agent-Id and
X-Nexus-Api-Key headers through NexusMcpTools. The ApiKeyMiddleware
now skips the /mcp path to avoid interfering with MCP's own auth flow.
This commit is contained in:
Developer
2026-07-13 16:11:09 +02:00
parent 6ba788bb6e
commit c4270a4975
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/Middleware/ApiKeyMiddleware.cs
+12
View File
@@ -6,11 +6,23 @@ namespace Nexus.Api.Middleware;
/// Middleware that authenticates requests via the X-Nexus-Api-Key header. /// Middleware that authenticates requests via the X-Nexus-Api-Key header.
/// On match, sets a ClaimsPrincipal with role "Service". /// On match, sets a ClaimsPrincipal with role "Service".
/// On mismatch or absent header, passes through to next middleware (JWT auth). /// On mismatch or absent header, passes through to next middleware (JWT auth).
///
/// The MCP endpoint (/mcp) is intentionally skipped — the MCP SDK handles its own
/// authentication via X-Agent-Id + X-Nexus-Api-Key headers through NexusMcpTools.
/// </summary> /// </summary>
public sealed class ApiKeyMiddleware(RequestDelegate next) public sealed class ApiKeyMiddleware(RequestDelegate next)
{ {
private static readonly PathString McpPath = new("/mcp");
public async Task InvokeAsync(HttpContext context) public async Task InvokeAsync(HttpContext context)
{ {
// MCP endpoint handles its own auth — skip ApiKey interference
if (context.Request.Path.StartsWithSegments(McpPath))
{
await next(context);
return;
}
var configuration = context.RequestServices.GetRequiredService<IConfiguration>(); var configuration = context.RequestServices.GetRequiredService<IConfiguration>();
var apiKey = configuration["NexusApiKey"]; var apiKey = configuration["NexusApiKey"];