MCP-328 Migrate HTTP authentication header to Authorization Bearer xxx

[nquinquenel]

No description provided.

[hashicorp-vault-sonar-prod]

MCP-328

[vnaskos-sonar]

All good, one minor comment 👍

[sonarqubecloud]

SonarQube reviewer guide

Summary: Migrate HTTP authentication from custom SONARQUBE_TOKEN header to standard Authorization: Bearer <token> format, maintaining backward compatibility.

Review Focus:

• The AuthenticationFilter.extractToken() method implements the dual-header support logic—verify the preference order (Bearer first, then legacy) and warning logging are correct
• Token extraction is now reused in HttpServerTransportProvider.contextExtractor(), ensuring consistency across authentication points
• CORS headers updated to allow Authorization header; verify this doesn't introduce security gaps
• All test updates accurately reflect the new authentication flow and edge cases

Start review at: src/main/java/org/sonarsource/sonarqube/mcp/authentication/AuthenticationFilter.java. This is the core authentication component where the dual-header support logic lives. Understanding how it prioritizes Authorization: Bearer over the deprecated SONARQUBE_TOKEN header and logs warnings is essential to validating the backward-compatibility strategy and ensuring no regressions in the authentication flow.

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
96.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud