github / github/copilot-cli

Authorization header length limit is too low to accomodate some Entra ID tokens

オープン
#2,960 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
area:mcp area:networking
主要言語
Shell
スター
11.2k
フォーク
1.9k
平均マージ
14時間 16分
マージ済み PR(30日)
6

説明

### Describe the bug

I'm trying to use the Grafana MCP over an Azure Managed Grafana instance, which authenticates with my Entra account, but it fails upon invoking the MCP commands with the following error:
```
MCP server 'grafana': An error occurred invoking 'amgmcp_datasource_list': Authorization header length 11034 exceeds maximum allowed length of 8192.
```
The issue being that I have a few too many AD Groups (but not enough to trigger the overflow yet), which causes my token to be fairly huge and go past the current 8k limit.
My understanding is that this limit happens on the Copilot side, as this exact setup is working fine in Claude Code.

### Affected version

GitHub Copilot CLI 1.0.35.

### Steps to reproduce the behavior

The MCP is configured as such:
```json
"grafana": {
"type": "http",
"url": "https://.eus.grafana.azure.com/api/azure-mcp",
"headers": {
"Authorization": "Bearer ${GRAFANA_MCP_TOKEN}"
},
"tools": [
"*"
],
},
```

And upon opening Copilot, I'm setting the environment variable like so:
```
export GRAFANA_MCP_TOKEN=$(az account get-access-token --resource "ce34e7e5-485f-4d76-964f-b3d2b16d1e4f" --query accessToken -o tsv)
```
To get an authorization token for the managed grafana resource. The token is indeed around 11kB long.

### Expected behavior

The header length limit should be higher, to accomodate the authorization tokens that might be generated in practice by users, apparently especially users of Entra ID which can get fairly large tokens of ~11-12kB

### Additional context

_No response_

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

Start by locating the 8192-byte authorization-header validation in the CLI's MCP request handling, then reproduce it with the Grafana configuration and token-generation command shown here. Done means realistic Entra ID tokens around 11–12 kB are accepted without the reported error and the relevant limit behavior is covered by tests.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
azure, shell
領域
authentication, cli
issue の種類
バグ
難易度
3/5
見積もり時間
1〜2日
活発さ
静か
明瞭さ
おおむね明確
初心者へのやさしさ
52/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。