Skip to content

Commit c7740fd

Browse files
committed
Improved Origin Validation Security
1 parent 4b79c50 commit c7740fd

File tree

2 files changed

+17
-10
lines changed

2 files changed

+17
-10
lines changed

server/streamable_http.go

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -232,6 +232,14 @@ func WithOriginAllowlist(allowlist []string) StreamableHTTPOption {
232232
})
233233
}
234234

235+
// WithAllowAllOrigins configures the server to accept requests from any origin
236+
func WithAllowAllOrigins() StreamableHTTPOption {
237+
return streamableHTTPOption(func(s *StreamableHTTPServer) {
238+
// Use a special marker to indicate "allow all"
239+
s.originAllowlist = []string{"*"}
240+
})
241+
}
242+
235243
// StreamableHTTPServer is the concrete implementation of a server that supports
236244
// the MCP Streamable HTTP transport specification.
237245
type StreamableHTTPServer struct {
@@ -1009,21 +1017,20 @@ func (s *StreamableHTTPServer) isValidOrigin(origin string) bool {
10091017
return false // Invalid URLs should always be rejected
10101018
}
10111019

1012-
// If no allowlist is configured, allow all valid origins
1013-
if len(s.originAllowlist) == 0 {
1014-
// Always allow localhost and 127.0.0.1
1015-
if originURL.Hostname() == "localhost" || originURL.Hostname() == "127.0.0.1" {
1016-
return true
1017-
}
1020+
// Always allow localhost and 127.0.0.1 for development
1021+
if originURL.Hostname() == "localhost" || originURL.Hostname() == "127.0.0.1" {
10181022
return true
10191023
}
10201024

1021-
// Always allow localhost and 127.0.0.1
1022-
if originURL.Hostname() == "localhost" || originURL.Hostname() == "127.0.0.1" {
1023-
return true
1025+
// If no allowlist is configured, only allow localhost/127.0.0.1 (already checked above)
1026+
if len(s.originAllowlist) == 0 {
1027+
return false
10241028
}
10251029

10261030
// Check against the allowlist
1031+
if len(s.originAllowlist) == 1 && s.originAllowlist[0] == "*" {
1032+
return true // Explicitly configured to allow all origins
1033+
}
10271034
for _, allowed := range s.originAllowlist {
10281035
// Check for wildcard subdomain pattern
10291036
if strings.HasPrefix(allowed, "*.") {

server/streamable_http_origin_validation_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ func TestOriginValidation(t *testing.T) {
2020
{"Localhost allowed", "http://localhost:3000", []string{}, true},
2121
{"127.0.0.1 allowed", "http://127.0.0.1:8080", []string{}, true},
2222
{"Multiple allowlist entries", "https://api.example.com", []string{"https://app.example.com", "https://api.example.com"}, true},
23-
{"Empty allowlist", "https://example.com", []string{}, true}, // Should allow all when no allowlist is configured
23+
{"Empty allowlist", "https://example.com", []string{}, false}, // Should only allow localhost/127.0.0.1 when no allowlist is configured
2424
{"Invalid URL", "://invalid-url", []string{}, false},
2525
}
2626

0 commit comments

Comments
 (0)