From 91b2b67d85376ffaa9961e562e3d06256884e006 Mon Sep 17 00:00:00 2001 From: jade Date: Tue, 18 Aug 2026 14:41:12 +0900 Subject: [PATCH] refactor(security): Change X-Tool-Server-API-Key header to apiKey --- .../java/io/shinhanlife/dap/mcg/service/ExecuteService.java | 4 ++++ .../shinhanlife/dap/lib/mcp/security/ApiKeyInterceptor.java | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/dap-gateway/src/main/java/io/shinhanlife/dap/mcg/service/ExecuteService.java b/dap-gateway/src/main/java/io/shinhanlife/dap/mcg/service/ExecuteService.java index 422c08db..188774e8 100644 --- a/dap-gateway/src/main/java/io/shinhanlife/dap/mcg/service/ExecuteService.java +++ b/dap-gateway/src/main/java/io/shinhanlife/dap/mcg/service/ExecuteService.java @@ -261,6 +261,10 @@ public class ExecuteService { Map headers = new java.util.HashMap<>(); headers.put("trace-id", context.requestId()); headers.put("request-id", java.util.UUID.randomUUID().toString()); + String apiKey = properties.toolServerApiKey(); + if (apiKey != null && !apiKey.isEmpty()) { + headers.put("apiKey", apiKey); + } ObjectNode pageArguments = paginationValidator.normalize(metadata, arguments); LargeToolResponseService.Collector collector = largeResponses.newCollector(metadata.getName(), context.requestId()); diff --git a/dap-was-lib/src/main/java/io/shinhanlife/dap/lib/mcp/security/ApiKeyInterceptor.java b/dap-was-lib/src/main/java/io/shinhanlife/dap/lib/mcp/security/ApiKeyInterceptor.java index a4c0295b..e0ba1f99 100644 --- a/dap-was-lib/src/main/java/io/shinhanlife/dap/lib/mcp/security/ApiKeyInterceptor.java +++ b/dap-was-lib/src/main/java/io/shinhanlife/dap/lib/mcp/security/ApiKeyInterceptor.java @@ -39,7 +39,7 @@ public class ApiKeyInterceptor implements HandlerInterceptor { return true; } - String apiKey = request.getHeader("X-Tool-Server-API-Key"); + String apiKey = request.getHeader("apiKey"); Map validApiKeys = securityProperties.getApiKeys(); // 2. 만약 프로퍼티에 API Key가 하나도 설정되어 있지 않다면 (개발/로컬 환경 등) 인증 없이 통과시킵니다.