Ensure token passthrough to downstream APIs is forbidden

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Inspect the proxy or gateway configuration and the token-handling middleware, and confirm the token presented downstream is a separate token audience-bound to the downstream API, not the inbound token. Run the following command to decode the inbound token and confirm its aud includes the MCP server and not the downstream API: TOKEN='<CLIENT_INBOUND_JWT>' MCP_SERVER_AUDIENCE="<MCP_SERVER_AUDIENCE>" DOWNSTREAM_API_AUDIENCE="<DOWNSTREAM_API_AUDIENCE>" seg=$(printf '%s' "$TOKEN" | cut -d. -f2 | tr '_-' '/+') pad=$(( (4 - ${#seg} % 4) % 4 )); seg="$seg$(printf '=%.0s' $(seq 1 $pad))" claims=$(printf '%s' "$seg" | base64 -d 2>/dev/null) [ -z "$claims" ] && { echo "ERROR: could not decode token (opaque token? use AS introspection)"; exit 0; } printf '%s' "$claims" | jq empty 2>/dev/null || { echo "ERROR: decoded payload is not JSON (opaque token? use AS introspection)"; exit 0; } echo "$claims" | jq '{aud, iss}' echo "$claims" | jq -e --arg mcp "$MCP_SERVER_AUDIENCE" --arg down "$DOWNSTREAM_API_AUDIENCE" ' (.aud | if type=="array" then . else [.] end) as $a | ($a | index($mcp)) != null and ($a | index($down)) == null' >/dev/null \ && echo "PASS: client token is bound to the MCP server,...

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

This is server or gateway logic with no portable command. On an inbound request, validate that the token's audience is this MCP server and reject it otherwise. To call a downstream API, obtain a separate token whose audience is that downstream API, using token exchange when acting on behalf of a user or client_credentials when the server acts as itself, and never forward the inbound token. Pair with audience and issuer alerting (see Recommendation 7.2.1) so passthrough or wrong-audience tokens raise an alert in production.