678acfe7ef
claude.ai's two-step "Add custom connector" dialog probes the server URL without credentials and pre-fills the Authentication choice from the answer. Our lazy-auth endpoint (issue #1814) answers 200 on an anonymous initialize, which the dialog reads as an authless server: it suggests "None", and a connector added with that default never opens the sign-in when the challenge arrives later. Per Anthropic's connector docs a 401 is the only answer it reads as OAuth ("Claude does not honor a WWW-Authenticate header on a 200 response"). - `auth=required` on the endpoint URL (extensions/general/mcp-server/ auth-mode.ts) turns lazy auth off for that URL: every tokenless request, initialize included, answers the 401 + WWW-Authenticate challenge. Callers with a token are unaffected; the bare URL keeps lazy auth for Claude Code, the plugin, Cursor and ChatGPT, and existing connector records are untouched. - The links we control carry the flag: Settings -> API & MCP (install link and copy block), the onboarding checklist, both docs pages and claude-plugin/CONNECTORS.md (plugin 1.2.3). The docs' Path A now describes the eager flow (sign-in opens on Add) instead of telling users to override the dialog's "None". - Tests: eager-auth.test.ts (401 on initialize/tools/list/public tools, namespaced metadata pointer, token no-op, exact-flag only); checklist link shape updated. Companion: gnubok-website PR (Kom igång connector link + regenerated connect-claude / anslut-claude pages). Claude-Session: https://claude.ai/code/session_013yw62FMXGSzo6icFDiBwP3 Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
32 lines
1.7 KiB
TypeScript
32 lines
1.7 KiB
TypeScript
/**
|
|
* Per-URL authentication mode for the MCP endpoint.
|
|
*
|
|
* The default is lazy (issue #1814): a client with no token may initialize,
|
|
* list the catalog and call the public documentation tools (public-tools.ts);
|
|
* the first protected call answers 401 + WWW-Authenticate, which the client
|
|
* turns into its Connect prompt.
|
|
*
|
|
* `auth=required` on the endpoint URL makes that URL eager instead: EVERY
|
|
* tokenless request answers the 401 challenge, `initialize` included. It has
|
|
* one consumer. claude.ai's two-step "Add custom connector" dialog probes the
|
|
* URL without credentials and pre-fills the Authentication choice from the
|
|
* answer (Anthropic: "Claude checks the URL and pre-fills the authentication
|
|
* settings it detects"). A 200 on that probe is read as "None", an authless
|
|
* server, and a connector added with that default never opens the sign-in
|
|
* when the challenge arrives later. A 401 is the only answer the dialog reads
|
|
* as OAuth (Anthropic: "Claude does not honor a WWW-Authenticate header on a
|
|
* 200 response"), so the links we control (Settings -> API & MCP, the
|
|
* onboarding checklist, both docs pages, the website) carry the flag.
|
|
*
|
|
* The bare URL keeps lazy authentication for Claude Code, the plugin, Cursor,
|
|
* ChatGPT developer mode and hand-typed adds, and connector records created
|
|
* before the flag existed are unaffected. Either way the flag only changes the
|
|
* answer to tokenless requests: a caller that holds a token never notices it.
|
|
*/
|
|
export const AUTH_MODE_QUERY_PARAM = 'auth'
|
|
export const AUTH_MODE_REQUIRED = 'required'
|
|
|
|
export function isEagerAuthRequested(request: Request): boolean {
|
|
return new URL(request.url).searchParams.get(AUTH_MODE_QUERY_PARAM) === AUTH_MODE_REQUIRED
|
|
}
|