modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

mcp: add DNS rebinding and cross origin protections to SSE transport (#891)

Browse source 
Similar protections were already introduced before to the Streamable
transport.
This commit is contained in:
Maciej Kisiel 2026-04-14 11:36:20 +02:00 • committed by GitHub
commit 15e93a231c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 236 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/mcpgodebug.md
View file

@ -24,7 +24,7 @@ Options listed below will be removed in the 1.6.0 version of the SDK.
- `disablecrossoriginprotection` added. If set to `1`, newly added cross-origin
protection will be disabled. The default behavior was changed to enable
cross-origin protection.
cross-origin protection. **Removal of this option was postponed until 1.7.0.**
### 1.4.0
@ -37,5 +37,6 @@ Options listed below will be removed in the 1.6.0 version of the SDK.
- `disablelocalhostprotection` added. If set to `1`, newly added DNS rebinding
protection will be disabled. The default behavior was changed to enable DNS rebinding
protection. The protection can also be disabled by setting the
`DisableLocalhostProtection` field in the `StreamableHTTPOptions` struct to
`true`, which is the recommended way to disable the protection long term.
`DisableLocalhostProtection` field in the `StreamableHTTPOptions` or
`SSEOptions` struct to `true`, which is the recommended way to disable
the protection long term. **Removal of this option was postponed until 1.7.0.**