common

const (
	ForwardedUriHeader    = "X-Forwarded-Uri"
	ForwardedMethodHeader = "X-Forwarded-Method"
)

ForwardedUriHeader and ForwardedMethodHeader carry the route under authorization to security-proxy-auth, matching its gateway-style contract.

const AuthReasonInsufficientScope = "insufficient_scope"

AuthReasonInsufficientScope is the stable RFC 6750 reason token put in authorization-refusal messages so clients can match on it.

const AuthorizationHeader = "Authorization"

AuthorizationHeader is the standard HTTP Authorization header, carrying the end user's bearer token on inbound MCP requests and on forwarded proxy-auth calls.

const ForwardedResourceHeader = "X-Forwarded-Resource"

ForwardedResourceHeader carries the MCP service's resource identifier so proxy-auth can confine a token to its bound audience (RFC 8707 aud).

const MCPPath = "/mcp"

MCPPath is the HTTP path the MCP Streamable transport listens on.