{"record":{"id":"a012857685fb3de5","repo":"ruvnet/ruflo","slug":"unauthorized-a01285","errorCode":null,"errorMessage":"unauthorized","messagePattern":"unauthorized","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"ruflo/src/mcp-bridge/index.js","lineNumber":926,"sourceCode":"    res.setHeader(\"Vary\", \"Origin\");\n  }\n  res.setHeader(\"Access-Control-Allow-Methods\", \"GET, POST, DELETE, OPTIONS\");\n  res.setHeader(\"Access-Control-Allow-Headers\", \"Content-Type, Authorization, Mcp-Session-Id\");\n  if (req.method === \"OPTIONS\") return res.sendStatus(204);\n  next();\n});\n\n// ---------- Auth middleware ----------\n// No-op in local-only mode (MCP_AUTH_TOKEN unset). Enforces 401 when token is set.\nconst MCP_TOKEN = process.env.MCP_AUTH_TOKEN || \"\";\nfunction requireAuth(req, res, next) {\n  if (req.path === \"/health\") return next();\n  if (!MCP_TOKEN) return next();\n  const expected = `Bearer ${MCP_TOKEN}`;\n  const got = req.get(\"authorization\") || \"\";\n  const ok = got.length === expected.length &&\n    timingSafeEqual(Buffer.from(got), Buffer.from(expected));\n  if (!ok) return res.status(401).json({ error: \"unauthorized\" });\n  next();\n}\napp.use(requireAuth);\n\n// ---------- Shared MCP handler ----------\nfunction createMcpHandler(groupName) {\n  return async (req, res) => {\n    const { method, id, params } = req.body;\n    try {\n      switch (method) {\n        case \"initialize\":\n          return res.json({\n            jsonrpc: \"2.0\", id,\n            result: {\n              protocolVersion: \"2024-11-05\",\n              capabilities: { tools: {} },\n              serverInfo: { name: `mcp-bridge/${groupName}`, version: \"2.0.0\" },\n            },","sourceCodeStart":908,"sourceCodeEnd":944,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/ruflo/src/mcp-bridge/index.js#L908-L944","documentation":"Auth middleware rejected the request: MCP_AUTH_TOKEN is set, the path is not /health, and the Authorization header did not carry the expected bearer token. The 401 is deliberate hardening when the bridge is exposed beyond localhost; in local-only mode (token unset) this middleware is a no-op.","triggerScenarios":"Thrown at ruflo/src/mcp-bridge/index.js:926 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide valid authentication credentials (API key or OAuth token) with the request.","Verify the token has not expired and that the credentials grant access to the requested resource; re-authenticate if needed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}