Merge pull request #614 from koic/allow_the_end_to_end_host_under_dns_rebinding_protection

Allow the end-to-end test's host under DNS rebinding protection

Author: koic

test/mcp/server/oauth/end_to_end_test.rb

@@ -46,7 +46,14 @@ def setup
           WhoamiTool.observations.clear
 
           @server = MCP::Server.new(name: "e2e_server", tools: [WhoamiTool])
-          @transport = Transports::StreamableHTTPTransport.new(@server, enable_json_response: true)
+          # The transport serves `mcp.example.com`, so the host is allow-listed as a deployment there would:
+          # DNS rebinding protection rejects any other `Host`, and WebMock 3.34 and later hand the Rack app
+          # the host of the request URL.
+          @transport = Transports::StreamableHTTPTransport.new(
+            @server,
+            enable_json_response: true,
+            allowed_hosts: [URI(MCP_URL).host],
+          )
 
           @metadata = ProtectedResourceMetadata.new(
             resource: MCP_URL,