1
46%
main: 46%

Ran 15 Apr 2026 05:36PM UTC

Files 691

Run time 21s

Badge

Embed ▾

Committed 15 Apr 2026 05:19PM UTC coverage: 45.438% (-0.03%) from 45.47%

Job # 24468250111.1

Build Type

push

github

Committed by

web-flow

Commit Message

fix: use X-Serverless-Authorization for Cloud Run serverless auth (#6268)

## Summary

Cloud Run supports `X-Serverless-Authorization` as a native alternative
to `Authorization` for IAM authentication. When present, Cloud Run uses
it for IAM and passes `Authorization` through to the container
untouched.

Switch to `X-Serverless-Authorization` unconditionally. This frees the
`Authorization` header for application-level use (`set_request_headers`,
MCP upstream OAuth, etc.) and fixes an incompatibility where MCP server
routes strip `Authorization` via `headers_to_remove`, which also deletes
the GCP identity token.

See: https://cloud.google.com/run/docs/authenticating/service-to-service

## Related issues

- ENG-3912

## User Explanation

Google Cloud Run serverless authentication now uses the
`X-Serverless-Authorization` header instead of `Authorization`. Cloud
Run checks this header first for IAM authentication. This frees the
`Authorization` header for application-level use and fixes MCP server
routes with Cloud Run auth.

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [ ] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review

Coverage Stats

35132 of 77319 relevant lines covered (45.44%)

115.06 hits per line

pomerium / pomerium / 24468250111 / 1
46%
main: 46%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 24468250111.1

pomerium / pomerium / 24468250111 / 1 46% main: 46%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 24468250111.1

pomerium / pomerium / 24468250111 / 1
46%
main: 46%

README BADGES
x