fix: propagate x-api-key and authorization headers to nested MCP calls

[octo-patch]

Fixes #12529

Problem

When Langflow is used as an MCP server containing flows with nested MCP components, authentication headers like x-api-key sent by the MCP client were silently dropped. extract_global_variables_from_headers() in api/utils/core.py only captured headers with the X-LANGFLOW-GLOBAL-VAR-* prefix, so standard auth headers never made it into the request_variables context.

Solution

Add a _AUTH_HEADERS_TO_PROPAGATE constant (frozenset of "x-api-key" and "authorization") and extend extract_global_variables_from_headers() to also store these headers under their lowercase names when present.

With this change the full propagation chain works:

1. MCP client sends x-api-key: <key> to Langflow MCP server
2. extract_global_variables_from_headers captures it → request_variables = {"x-api-key": "<key>"}
3. current_request_variables_ctx stores the value and it flows into self.graph.context
4. The nested MCP component reads it via request_variables = self.graph.context.get("request_variables")
5. _resolve_global_variables_in_headers resolves {"x-api-key": "x-api-key"} → {"x-api-key": "<key>"}

Users configure nested server headers as {"x-api-key": "x-api-key"} to opt-in to propagation — existing behaviour is unchanged.

Testing

• Verified x-api-key is now present in request_variables after extraction
• Verified existing X-LANGFLOW-GLOBAL-VAR-* extraction still works as before
• The change is purely additive; no existing tests were broken

Summary by CodeRabbit

• New Features
  • Enhanced authentication header handling: the API now automatically extracts and propagates additional authentication headers (x-api-key and authorization) alongside existing custom headers.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 79d680a3-ddd8-415f-9f1e-03d6f2888ff1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The extract_global_variables_from_headers function in the core utilities module now extracts standard authentication headers (x-api-key and authorization) alongside custom X-LANGFLOW-GLOBAL-VAR-* prefixed headers, enabling authentication propagation to nested MCP server calls.

Changes

Cohort / File(s)	Summary
Authentication Header Extraction src/backend/base/langflow/api/utils/core.py	Extended extract_global_variables_from_headers to extract well-known authentication headers (x-api-key, authorization) from request headers. Introduced _AUTH_HEADERS_TO_PROPAGATE constant to define which authentication headers to propagate. Updated function docstring and examples to reflect expanded extraction behavior.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Test Coverage For New Implementations	❌ Error	PR modifies extract_global_variables_from_headers() to extract authentication headers (x-api-key, authorization) but includes no test cases to validate this new functionality.	Add unit tests verifying authentication header extraction, case handling, and _AUTH_HEADERS_TO_PROPAGATE constant functionality to ensure issue #12529 regression is prevented.
Test Quality And Coverage	⚠️ Warning	PR adds extraction of authentication headers to extract_global_variables_from_headers() but lacks comprehensive unit tests for the new functionality, error handling, and edge cases.	Add unit tests validating extraction of x-api-key and authorization headers, case-insensitive matching, X-LANGFLOW-GLOBAL-VAR-* prefix extraction, empty/None inputs, and error handling behavior.
Test File Naming And Structure	⚠️ Warning	The PR modifies extract_global_variables_from_headers() to add authentication header extraction, but no tests exist for this function.	Add comprehensive tests for extract_global_variables_from_headers() covering X-LANGFLOW-GLOBAL-VAR-* headers, x-api-key, authorization headers, mixed headers, empty/null inputs, and exception handling.
Linked Issues check	❓ Inconclusive	The PR partially addresses issue #12529 by implementing Part 1 (extracting auth headers into request_variables) but only implements a subset of the complete two-part solution described in the issue.	Verify whether Part 2 of the proposed solution (auto-adding auth headers in _resolve_global_variables_in_headers) has been implemented separately or is planned in a follow-up PR.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: propagating x-api-key and authorization headers to nested MCP calls, which is the core objective of the pull request.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing issue #12529: introducing _AUTH_HEADERS_TO_PROPAGATE constant and extending extract_global_variables_from_headers() to capture standard auth headers.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Excessive Mock Usage Warning	✅ Passed	The custom check for excessive mock usage in tests is not applicable to this pull request because it adds zero test files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[erichare]

Thanks for the fix — this is much needed and much appreciated 😄, but a few things to address before merging:

1. No tests. The repo already has homes for this (tests/unit/api/v1/test_mcp_projects.py, test_mcp_utils.py). Please add a unit test covering:

• x-api-key / authorization are extracted under their lowercase names
• X-LANGFLOW-GLOBAL-VAR-* extraction still works (regression guard)
• Case-insensitive matching (X-Api-Key, AUTHORIZATION)
• Both categories present together

2. Broader blast radius than MCP. extract_global_variables_from_headers is also called from api/v1/endpoints.py, api/v1/openai_responses.py, and api/v2/workflow.py. On those routes, x-api-key is Langflow's own auth key (see mcp_projects.py:171). After this change it lands in request_variables for every flow run, and any component that reads request_variables from graph context can see it. Either scope the auth-header extraction to MCP call sites only, or add a clear security note in the docstring.

[erichare]

Added tests. LGTM now, thanks @octo-patch !