[Bug]: authentication Field in Push Notification Config Ignored #239
Description
What happened?
I have observed that in the _dispatchNotification function of the DefaultPushNotificationSender, the authentication field from the client’s push notification configuration appears to be ignored. Only the token property is being used, and it is sent via the X-A2A-Notification-Token header.
Based on the structure of the authentication field (with schemes and credentials), my expectation was that it would allow passing standard authentication information—such as a Bearer token or Basic Authentication—for protected webhook endpoints. However, since the field is not currently processed, webhook servers do not receive standard Authorization headers and must handle the custom X-A2A-Notification-Token header instead.
This seems to require implementing custom logic on the receiving side, rather than just using the Authorization header.
Is the intention that only the token field should be used for webhook authentication, or might there be plans to support the authentication field for standard authorization headers in the future?
For reference, here’s an example of how the authentication field could be processed:
if (pushConfig.authentication && pushConfig.authentication.credentials) {
const { schemes, credentials } = pushConfig.authentication;
if (schemes.includes("Bearer")) {
headers["Authorization"] = `Bearer ${credentials}`;
}
if (schemes.includes("Basic")) {
headers["Authorization"] = `Basic ${credentials}`;
}
}
And an example client configuration:
configuration: {
pushNotificationConfig: {
url: 'https://example.com/webhook',
authentication: {
schemes: ["Bearer"],
credentials: "eyabcde"
}
}
}
Relevant log output
Code of Conduct
- I agree to follow this project's Code of Conduct