makiolaj/GearBox
1
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases 10 Wiki Activity

fix: await verifyAccessToken in MCP middleware
All checks were successful
CI / ci (push) Successful in 31s
Details
CI / e2e (push) Successful in 1m4s
Details

Browse Source 
verifyAccessToken is async and returns a Promise. Without await,
the Promise object is always truthy, so any Bearer token (even
invalid ones) was accepted. This fixes MCP OAuth authentication.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jean-Luc Makiola
2026-04-04 11:03:30 +02:00
parent 9c7bc2881c
commit b71833ef79
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/server/mcp/index.ts
View File

@@ -99,7 +99,7 @@ mcpRoutes.use("/*", async (c, next) => {
const authHeader = c.req.header("Authorization"); const authHeader = c.req.header("Authorization");
if (authHeader?.startsWith("Bearer ")) { if (authHeader?.startsWith("Bearer ")) {
const token = authHeader.slice(7); const token = authHeader.slice(7);
if (verifyAccessToken(db, token)) { if (await verifyAccessToken(db, token)) {
return next(); return next();
} }
return c.json({ error: "invalid_token" }, 401); return c.json({ error: "invalid_token" }, 401);