🛡️ MCP Security Alliance

📄 authentication.md

Authentication and Authorization in MCP

Authentication Methods

API Key Authentication

# Example secure API key validation
def validate_api_key(api_key):
    # Use secure comparison to prevent timing attacks
    return hmac.compare_digest(api_key, expected_key)

OAuth 2.0 Integration

• Implement OAuth 2.0 for enterprise integrations
• Use PKCE for public clients
• Validate tokens properly

Mutual TLS (mTLS)

• Client certificate authentication
• Enhanced security for server-to-server communication
• Certificate validation and revocation checking

Authorization Patterns

Role-Based Access Control (RBAC)

class Permission:
    READ = "read"
    WRITE = "write"
    ADMIN = "admin"

def check_permission(user_role, required_permission):
    role_permissions = {
        "viewer": [Permission.READ],
        "editor": [Permission.READ, Permission.WRITE],
        "admin": [Permission.READ, Permission.WRITE, Permission.ADMIN]
    }
    return required_permission in role_permissions.get(user_role, [])

Attribute-Based Access Control (ABAC)

• Fine-grained access control
• Context-aware decisions
• Dynamic policy evaluation

Best Practices

Secure Token Management

Token Storage:

• Use secure storage mechanisms
• Encrypt tokens at rest
• Implement token rotation

Token Validation:

• Verify token signature
• Check expiration times
• Validate issuer and audience

Session Management:

• Implement session timeouts
• Use secure session identifiers
• Proper session invalidation

Multi-Factor Authentication (MFA)

• TOTP (Time-based One-Time Password)
• SMS/Email verification
• Hardware security keys

Common Vulnerabilities

Authentication Bypass

• Missing authentication checks
• Weak token validation
• Predictable session identifiers

Privilege Escalation

• Insufficient authorization checks
• Role confusion attacks
• Parameter tampering

Implementation Example

from functools import wraps
import jwt

def require_auth(required_permission=None):
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            token = request.headers.get('Authorization')
            if not token:
                return {'error': 'No token provided'}, 401
            
            try:
                # Remove 'Bearer ' prefix
                token = token.split(' ')[1]
                payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256'])
                
                if required_permission:
                    if not check_permission(payload.get('role'), required_permission):
                        return {'error': 'Insufficient permissions'}, 403
                
                return f(*args, **kwargs)
            except jwt.InvalidTokenError:
                return {'error': 'Invalid token'}, 401
        
        return decorated_function
    return decorator

# Usage
@require_auth(Permission.WRITE)
def update_resource():
    # Function implementation
    pass

Testing Authentication

Automated Testing

• Unit tests for authentication functions
• Integration tests for auth flows
• Security scanning tools

Manual Testing

• Test for authentication bypass
• Verify token validation
• Check authorization boundaries

References

• OWASP Authentication Cheat Sheet
• NIST Digital Identity Guidelines