modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

mcp: add DNS rebinding and cross origin protections to SSE transport (#891)

Browse source 
Similar protections were already introduced before to the Streamable
transport.
This commit is contained in:
Maciej Kisiel 2026-04-14 11:36:20 +02:00 • committed by GitHub
commit 15e93a231c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 236 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

6
mcp/streamable.go
View file

@ -182,7 +182,7 @@ type StreamableHTTPOptions struct {
// is ignored.
// If nil, default (zero-value) cross-origin protection will be used.
// Use `disablecrossoriginprotection` MCPGODEBUG compatibility parameter
// to disable the default protection until v1.6.0.
// to disable the default protection until v1.7.0.
CrossOriginProtection *http.CrossOriginProtection
}
@ -235,14 +235,14 @@ func (h *StreamableHTTPHandler) closeAll() {
// disablelocalhostprotection is a compatibility parameter that allows to disable
// DNS rebinding protection, which was added in the 1.4.0 version of the SDK.
// See the documentation for the mcpgodebug package for instructions how to enable it.
// The option will be removed in the 1.6.0 version of the SDK.
// The option will be removed in the 1.7.0 version of the SDK.
var disablelocalhostprotection = mcpgodebug.Value("disablelocalhostprotection")
// disablecrossoriginprotection is a compatibility parameter that allows to disable
// the verification of the 'Origin' and 'Content-Type' headers, which was added in
// the 1.4.1 version of the SDK. See the documentation for the mcpgodebug package
// for instructions how to enable it.
// The option will be removed in the 1.6.0 version of the SDK.
// The option will be removed in the 1.7.0 version of the SDK.
var disablecrossoriginprotection = mcpgodebug.Value("disablecrossoriginprotection")
func (h *StreamableHTTPHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {