fix: ensure that plaintext API key secret ref is not exposed in MCP backend HTTPRoute#2134
Open
aishwaryaraimule21 wants to merge 11 commits into
Open
fix: ensure that plaintext API key secret ref is not exposed in MCP backend HTTPRoute#2134aishwaryaraimule21 wants to merge 11 commits into
aishwaryaraimule21 wants to merge 11 commits into
Conversation
… filters Signed-off-by: Aishwarya <aishwarya.raimule@nutanix.com>
…viours of queryparam, inline Signed-off-by: Aishwarya <aishwarya.raimule@nutanix.com>
dosubot
Bot
added
the
size:L
Hritik003
reviewed
May 18, 2026
Comment on lines
+773
to
+775
| Data: map[string][]byte{ | ||
| "credential": []byte(credentialValue), | ||
| }, |
Contributor
There was a problem hiding this comment.
can we use the named constant from EG just so that this is tightly coupled to Envoy Gateway's filter expectations?
…e InjectedCredentialKey instead of the deprecated credential key. Signed-off-by: Aishwarya <aishwarya.raimule@nutanix.com>
…1/ai-gateway into cred-inj-mcp-httproute Signed-off-by: Aishwarya <aishwarya.raimule@nutanix.com>
Signed-off-by: Aishwarya <aishwarya.raimule@nutanix.com>
…edentials in URLs Signed-off-by: Aishwarya <aishwarya.raimule@nutanix.com>
…1/ai-gateway into cred-inj-mcp-httproute Signed-off-by: Aishwarya <aishwarya.raimule@nutanix.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
When an
MCPRoutehas abackendRefwithsecurityPolicy.apiKeyconfigured (either viasecretReforinline), the controller resolves the secret and embeds the plaintext API key directly into the generatedHTTPRouteresource. This happens in two places:HTTPRouteFilterof typeRequestHeaderModifier(e.g.,Authorization: Bearer <plaintext-token>).URLRewritefilter (e.g.,/mcp?api_key=<plaintext-token>).fixes #2141
Possible Solutions
QueryParamswill still continue to be stored in plaintext. Note: This PR implements this approach.BackendSecurityPolicy(used byAIGatewayRoute/AIServiceBackend) stores the resolved credential inside a Kubernetes Secret (the filter config secret consumed by extproc), which benefits from RBAC, encryption at rest, and audit logging. MCPRoute should adopt a similar approach.Affected code:
Testing
Created MCPRoute with credential injection into Authorization header.
Credential got created and HTTPRouteFilter with Credential Injection filter got created. List tools and tool calls work as expected. Credential and filter got deleted on removing backend and deleting MCPRoute.
Created MCPRoute with credential injection into a custom header.
Credential got created and HTTPRouteFilter with Credential Injection filter got created. List tools and tool calls work as expected. Credential and filter got deleted on removing backend and deleting MCPRoute.
Created MCPRoute with inline API Key into Authorization header.
No change in behaviour.
Created MCPRoute with API Key injected into query param
No change in behaviour.