@@ -108,6 +108,20 @@ function rejectsBrowserLoopbackRequest(req: IncomingMessage): boolean {
108108}).ok;
109109}
110110111+function resolveMcpSender(params: {
112+req: IncomingMessage;
113+ownerToken: string;
114+nonOwnerToken: string;
115+}): { senderIsOwner: boolean } | undefined {
116+const authHeader = getHeader(params.req, "authorization") ?? "";
117+const ownerTokenMatched = safeEqualSecret(authHeader, `Bearer ${params.ownerToken}`);
118+const nonOwnerTokenMatched = safeEqualSecret(authHeader, `Bearer ${params.nonOwnerToken}`);
119+if (!ownerTokenMatched && !nonOwnerTokenMatched) {
120+return undefined;
121+}
122+return { senderIsOwner: ownerTokenMatched };
123+}
124+111125export function validateMcpLoopbackRequest(params: {
112126req: IncomingMessage;
113127res: ServerResponse;
@@ -151,10 +165,8 @@ export function validateMcpLoopbackRequest(params: {
151165params.res.end(JSON.stringify({ error: "forbidden" }));
152166return null;
153167}
154-const authHeader = getHeader(params.req, "authorization") ?? "";
155-const ownerTokenMatched = safeEqualSecret(authHeader, `Bearer ${params.ownerToken}`);
156-const nonOwnerTokenMatched = safeEqualSecret(authHeader, `Bearer ${params.nonOwnerToken}`);
157-if (!ownerTokenMatched && !nonOwnerTokenMatched) {
168+const sender = resolveMcpSender(params);
169+if (!sender) {
158170params.res.writeHead(401, { "Content-Type": "application/json" });
159171params.res.end(JSON.stringify({ error: "unauthorized" }));
160172return null;
@@ -186,10 +198,8 @@ export function validateMcpLoopbackRequest(params: {
186198params.res.end(JSON.stringify({ error: "forbidden" }));
187199return null;
188200}
189-const authHeader = getHeader(params.req, "authorization") ?? "";
190-const ownerTokenMatched = safeEqualSecret(authHeader, `Bearer ${params.ownerToken}`);
191-const nonOwnerTokenMatched = safeEqualSecret(authHeader, `Bearer ${params.nonOwnerToken}`);
192-if (!ownerTokenMatched && !nonOwnerTokenMatched) {
201+const sender = resolveMcpSender(params);
202+if (!sender) {
193203params.res.writeHead(401, { "Content-Type": "application/json" });
194204params.res.end(JSON.stringify({ error: "unauthorized" }));
195205return null;
@@ -222,15 +232,12 @@ export function validateMcpLoopbackRequest(params: {
222232return null;
223233}
224234225-const authHeader = getHeader(params.req, "authorization") ?? "";
226-const ownerTokenMatched = safeEqualSecret(authHeader, `Bearer ${params.ownerToken}`);
227-const nonOwnerTokenMatched = safeEqualSecret(authHeader, `Bearer ${params.nonOwnerToken}`);
228-const senderIsOwner = ownerTokenMatched ? true : nonOwnerTokenMatched ? false : null;
229-if (senderIsOwner === null) {
235+const sender = resolveMcpSender(params);
236+if (!sender) {
230237logMcpLoopbackHttp("reject", {
231238reason: "unauthorized",
232239method: params.req.method ?? "",
233-hasAuthorization: authHeader.length > 0,
240+hasAuthorization: (getHeader(params.req, "authorization") ?? "").length > 0,
234241});
235242params.res.writeHead(401, { "Content-Type": "application/json" });
236243params.res.end(JSON.stringify({ error: "unauthorized" }));
@@ -249,7 +256,7 @@ export function validateMcpLoopbackRequest(params: {
249256return null;
250257}
251258252-return { senderIsOwner };
259+return { senderIsOwner: sender.senderIsOwner };
253260}
254261255262export async function readMcpHttpBody(
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。