server

Overview ¶

Code generated by apic; DO NOT EDIT.

SEC-0008: MCP WebSocket boot-time origin gate.

validateMCPWSBootConfig is the boot-time partner to wsx.UpgradeStrict in the MCP WS path (pkg/mcpx/engine.go). When MCP WS is enabled in rc.MCP.Transport, the operator MUST either configure a non-empty security.cors.origins (with cors.enabled=true) or explicitly opt in to any-origin via APIC_MCP_WS_ALLOW_ANY_ORIGIN=true.

The legacy fail-open default — nil allowlist disables Origin checking — allowed cross-origin WS hijack on the privileged MCP surface (CWE-346 origin validation, CWE-942 permissive cross-domain policy, OWASP A05:2021 security misconfiguration). Refusing to boot surfaces the misconfiguration immediately rather than silently running a vulnerable server.

SEC-0007: hybrid auth gate on /api-spec.json.

stripPublicSpec produces a redacted copy of the embedded runtime configuration that is safe to expose unauthenticated. The full spec remains available behind authSurface(...) at /api-spec.json?include=internal for operators and authenticated tooling.

The redaction targets information that materially aids an unauthenticated reconnaissance step (CWE-200, OWASP A05:2021):

• security.auth : reveals which auth modes are enabled and the JWT issuer/audience claims.
• security.cors.origins : reveals the trusted browser origins.
• server.bind, server.tls.* : reveals deployment topology and on-disk TLS material locations.
• api[].auth, .required_roles, .required_scopes, .required_attributes : RBAC hints; clients learn endpoint existence but not policy.
• websocket[].auth, .origins : same RBAC/CORS hints for WS.
• api[]/websocket[]/mcp.tools[] entries flagged "internal": true or "x-internal": true are removed entirely.

Public-useful fields are intentionally preserved: paths, methods, schema names, schema bodies, rateLimit, maxBodyBytes, timeouts, limits.max_body_bytes, etc. — these help honest clients without leaking authn/authz topology.