pomerium / pomerium / 24468250111

45%

Build Type

push

github

Committed by web-flow

Commit Message

fix: use X-Serverless-Authorization for Cloud Run serverless auth (#6268)

## Summary

Cloud Run supports `X-Serverless-Authorization` as a native alternative
to `Authorization` for IAM authentication. When present, Cloud Run uses
it for IAM and passes `Authorization` through to the container
untouched.

Switch to `X-Serverless-Authorization` unconditionally. This frees the
`Authorization` header for application-level use (`set_request_headers`,
MCP upstream OAuth, etc.) and fixes an incompatibility where MCP server
routes strip `Authorization` via `headers_to_remove`, which also deletes
the GCP identity token.

See: https://cloud.google.com/run/docs/authenticating/service-to-service

## Related issues

- ENG-3912

## User Explanation

Google Cloud Run serverless authentication now uses the
`X-Serverless-Authorization` header instead of `Authorization`. Cloud
Run checks this header first for IAM authentication. This frees the
`Authorization` header for application-level use and fixes MCP server
routes with Cloud Run auth.

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [ ] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review

Coverage Stats

1 of 1 new or added line in 1 file covered. (100.0%)

35 existing lines in 10 files now uncovered.

35132 of 77319 relevant lines covered (45.44%)

115.06 hits per line