Surfaced by automated review on #875 (the finding anchors on new code, but the behavior is the long-standing shared bridge path used by both /mcp and /mcp/{server}).
Today RmcpBridge::connect accepts http:// upstream URLs for credentialed MCP servers, and the underlying HTTP client follows redirects. reqwest strips Authorization on cross-origin redirects, but custom credential headers (e.g. an api_key auth header) are not in its sensitive-header set, so a compromised/misconfigured upstream could bounce a credentialed request to another origin with the credential attached.
Worth deciding deliberately:
- whether credentialed
type: mcp upstreams should require https (probably as a warning first — plain http to cluster-internal MCP servers is a common lawful deployment, and hard-rejecting would break them),
- whether the MCP client should disable redirect-following (MCP endpoints don't legitimately redirect mid-protocol),
- marking custom credential headers sensitive if redirects stay enabled.
Not done in #875 because it would change established transport behavior for every existing registered server, well beyond that PR's routing scope.
Surfaced by automated review on #875 (the finding anchors on new code, but the behavior is the long-standing shared bridge path used by both /mcp and /mcp/{server}).
Today
RmcpBridge::connectacceptshttp://upstream URLs for credentialed MCP servers, and the underlying HTTP client follows redirects. reqwest stripsAuthorizationon cross-origin redirects, but custom credential headers (e.g. anapi_keyauth header) are not in its sensitive-header set, so a compromised/misconfigured upstream could bounce a credentialed request to another origin with the credential attached.Worth deciding deliberately:
type: mcpupstreams should require https (probably as a warning first — plain http to cluster-internal MCP servers is a common lawful deployment, and hard-rejecting would break them),Not done in #875 because it would change established transport behavior for every existing registered server, well beyond that PR's routing scope.