mirror of
https://github.com/pomerium/pomerium.git
synced 2026-08-14 18:30:31 +02:00
Pomerium is an identity and context-aware access proxy.
- Go 91.2%
- TypeScript 6.6%
- JavaScript 0.6%
- Shell 0.6%
- Jsonnet 0.5%
- Other 0.5%
8639d614ed## Summary Opaque MCP tokens minted by Pomerium are now self-describing: access tokens are prefixed `pom_mat_` and refresh tokens `pom_mrt_`. Previously both were bare base64 blobs, indistinguishable from each other and from any other opaque credential in a log, a config file, or a bug report. Parsing dual-accepts prefixed and unprefixed tokens, so tokens issued before this change keep working until they expire. `_` does not appear in the standard-base64 token body, so trimming an absent prefix cannot corrupt a bare token. This is in anticipation of being able to distinguish two different sources of tokens arriving to MCP routes - issued to interactive users and to workloads executing on behalf of the users. ## Related - https://github.blog/engineering/platform-security/behind-githubs-new-authentication-token-formats/ ## User Explanation MCP access and refresh tokens issued by Pomerium now start with `pom_mat_` and `pom_mrt_` respectively. This makes the token type obvious on sight and lets secret scanners recognize a leaked Pomerium MCP token. Existing tokens continue to be accepted, so no client needs to re-authenticate. ## AI disclosure Claude Code: extracted the change from a larger branch, wrote the tests, and drafted this description; reviewed by me. ## Checklist - [x] reference any related issues - [x] updated unit tests - [x] add appropriate label (`enhancement`, `bug`, `breaking`, `dependencies`, `ci`) - [x] disclosed AI usage (or wrote "none") per AI_POLICY.md - [ ] ready for review |
||
|---|---|---|
| .github | ||
| authenticate | ||
| authorize | ||
| cmd/pomerium | ||
| config | ||
| databroker | ||
| examples | ||
| integration | ||
| internal | ||
| k8s/zero | ||
| ospkg | ||
| pkg | ||
| proxy | ||
| scripts | ||
| ui | ||
| .clang-format | ||
| .dockerignore | ||
| .gitattributes | ||
| .gitignore | ||
| .golangci.yml | ||
| .pre-commit-config.yaml | ||
| .tool-versions | ||
| AGENTS.md | ||
| AI_POLICY.md | ||
| DEBUG.MD | ||
| Dockerfile | ||
| go.mod | ||
| go.sum | ||
| go.work | ||
| go.work.sum | ||
| LICENSE | ||
| Makefile | ||
| pomerium.go | ||
| README.md | ||
| SECURITY.md | ||
Pomerium is an identity and context-aware reverse proxy. Pomerium builds secure, clientless connections to internal web apps and other services without a corporate VPN.
Pomerium is:
- Easier with clientless access.
- Faster by being tunnel-free and deployed where your apps and services are.
- Safer because every single action is verified before allowed to execute.
- Tailored to your organization’s needs by integrating all data for context-aware access.
It’s not a VPN alternative – it’s the trusted, foolproof way to protect your business. Want a hosted control plane and management GUI? Give Pomerium Zero a try today!
Docs
For comprehensive docs, and tutorials see our documentation.
Contributing
See Contributing for information on how you can contribute to Pomerium.