fix: require auth in LSP middleware

[mscolnick]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
marimo-docs	Ready	Preview, Comment	Apr 13, 2026 1:47pm

[Copilot]

Pull request overview

This PR tightens access control for proxied endpoints by making the server’s ProxyMiddleware require an authenticated user by default, and adds regression tests to ensure LSP proxy routes reject unauthenticated HTTP and WebSocket traffic.

Changes:

• Add a require_auth (default True) flag to ProxyMiddleware and reject unauthenticated HTTP/WebSocket proxy requests.
• Update existing proxy middleware tests to supply auth where required and explicitly disable auth for static proxying.
• Add a focused test suite validating LSP proxy auth behavior (HTTP and WebSocket).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
marimo/_server/api/middleware.py	Adds auth gating to ProxyMiddleware with explicit unauthenticated rejection paths for HTTP and WebSocket.
tests/_server/api/test_middleware.py	Updates proxy tests for the new default auth requirement and adds LSP proxy auth coverage.