pomerium / pomerium / 20802416424

46%

Build Type

push

github

Committed by web-flow

Commit Message

mcp: set www-authenticate header in unauthorized response (#6035)

## Summary


https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#authorization-server-location

> WWW-Authenticate Header: Include the resource metadata URL in the
WWW-Authenticate HTTP header under resource_metadata when returning 401
Unauthorized responses, as described in RFC 9728 Section 5.1.
> MCP servers SHOULD include a scope parameter in the WWW-Authenticate
header as defined in RFC 6750 Section 3 to indicate the scopes required
for accessing the resource.

We will be returning `www-authenticate` header with `resource_metadata`,
however we would not return any scopes requires anymore, as they now
have expanded lifecycle in the 11/25 MCP spec update.
We will also not return `realm` as it is not required. 

## Related issues

Fix
https://linear.app/pomerium/issue/ENG-3434/mcp-www-authenticate-with-resource-metadata

## User Explanation

<!-- How would you explain this change to the user? If this
change doesn't create any user-facing changes, you can leave
this blank. If filled out, add the `docs` label -->

## Checklist

- [ ] reference any related issues
- [ ] updated unit tests
- [ ] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review

Run Details

7 of 8 new or added lines in 2 files covered. (87.5%)

1 existing line in 1 file now uncovered.

29611 of 55900 relevant lines covered (52.97%)

127.45 hits per line