Repository navigation
Conversation
The MCP Streamable HTTP transport requires servers to validate Origin against DNS rebinding: a web page can make a browser send requests to 127.0.0.1, with the page's Origin. A request with an Origin header that mcp_http.allowed_origins (new, read-only, default none; exact match, ASCII case-insensitive) does not list now gets 403 before the token is checked. Requests without Origin (non-browser clients) are not affected. test-mcp-endpoint.sh: foreign and localhost origins refused by default, listed origins pass (case, spaces), a prefix is refused. 36 checks. Part of #256 (RFC 0001 Phase 5). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 50 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: abc53199d2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| req.send_reply(HttpStatusCode::MethodNotAllowed); | ||
| return; | ||
| } | ||
| if (!origin_ok(req.get_input_headers().find("Origin"))) { |
There was a problem hiding this comment.
When a browser client runs on a different origin, its MCP POST with Authorization and application/json triggers an OPTIONS preflight. The handler rejects non-POST methods before reaching this check and does not return CORS headers, so configuring the newly documented Inspector origin still cannot let that browser call the endpoint.
Useful? React with 👍 / 👎.
Phase 5 item from #256:
Originvalidation (MCP spec, against DNS rebinding).Problem
The endpoint listens on
127.0.0.1. Through DNS rebinding, a web page can still make the user's browser send requests to it, and the browser then sends the page'sOrigin. The MCP Streamable HTTP transport spec says servers MUST validateOrigin.Change
mcp_http.allowed_originssetting: read-only, a comma-separated list, empty by default.Originheader isn't in the list gets 403, before the bearer token is checked.Origin(non-browser clients such as Claude Desktop, Cursor, or curl) aren't affected.Tests
scripts/test-mcp-endpoint.shonmysql:26.10.0: 36 passed, 0 failed.localhostorigin are both refused (403), even with a valid token.allowed_origins = 'http://localhost:6274, https://Inspector.example':http://localhost:62) is refused;Docs: settings table, CHANGELOG.
Independent of #257, #258 and #259.
Part of #256.
🤖 Generated with Claude Code