mcp: verify 'Origin' and 'Content-Type' headers (#842)

This PR introduces protection against cross-origin requests by
installing `http.CrossOriginProtection`.
By default, the zero value is used which does not contain any trusted
origins or bypass patterns.
The protection can be customized by providing a custom
`http.CrossOriginProtection` in `mcp.StreamableHTTPOptions`. Currently,
the deny handler set on the protection is ignored.
This default has an MCPGODEBUG option (`disableoriginverification`) to
disable the default protection.
It will be available until `v1.6.0` of the SDK.
We also increase the Go version required by the SDK to 1.25, since this
is the version that introduced `http.CrossOriginProtection`. This is in
line with the SDK's policy of supporting two newest Go versions (1.26
was released in February 2026).

Additionally, we start validating if the `Content-Type` header for
`POST` requests is set to `application/json` to avoid accepting
CORS-safelisted requests.

internal/docs/README.src.md

@@ -38,6 +38,11 @@ protocol.
 
 See [troubleshooting.md](troubleshooting.md) for a troubleshooting guide.
 
+# Backwards compatibility
+
+See [mcpgodebug.md](mcpgodebug.md) for a list of backwards incompatible behavior changes
+and description how they can be temporarily undone.
+
 # Rough edges
 
 See [rough_edges.md](rough_edges.md) for a list of rough edges or API

internal/docs/doc.go

@@ -9,6 +9,7 @@
 //go:generate weave -o ../../docs/server.md ./server.src.md
 //go:generate weave -o ../../docs/troubleshooting.md ./troubleshooting.src.md
 //go:generate weave -o ../../docs/rough_edges.md ./rough_edges.src.md
+//go:generate weave -o ../../docs/mcpgodebug.md ./mcpgodebug.src.md
 
 // The doc package generates the documentation at /doc, via go:generate.
 //

internal/docs/mcpgodebug.src.md

@@ -0,0 +1,40 @@
+ # Backwards compatibility and MCPGODEBUG
+
+ According to our compatibility promise, we can't break backward compatibility
+ of the SDK API. However, sometimes we need to change the behavior of the SDK
+ in a backward-incompatible way in order to fix bugs or security issues.
+ In those cases we introduce temporary compatibility parameters, that can be
+ used to opt-out of the new behavior. They are usually maintained for two
+ minor release cycles and then removed.
+
+ The compatibility parameters are provided via the `MCPGODEBUG` environment
+ variable. The value of the variable is a comma-separated list of parameter
+ value assignments, e.g.:
+
+ ```
+ MCPGODEBUG=parameter1=value1,parameter2=value2
+ ```
+
+## `MCPGODEBUG` history
+
+### 1.4.1
+
+Options listed below will be removed in the 1.6.0 version of the SDK.
+
+- `disablecrossoriginprotection` added. If set to `1`, newly added cross-origin
+  protection will be disabled. The default behavior was changed to enable
+  cross-origin protection.
+
+### 1.4.0
+
+Options listed below will be removed in the 1.6.0 version of the SDK.
+
+- `jsonescaping` added. If set to `1`, JSON marshaling will preserve the previous
+  behavior of escaping HTML characters in JSON strings. The default behavior
+  was changed to not escape HTML characters, to be consistent with other SDKs.
+
+- `disablelocalhostprotection` added. If set to `1`, newly added DNS rebinding
+  protection will be disabled. The default behavior was changed to enable DNS rebinding
+  protection. The protection can also be disabled by setting the
+  `DisableLocalhostProtection` field in the `StreamableHTTPOptions` struct to
+  `true`, which is the recommended way to disable the protection long term.

internal/docs/protocol.src.md

@@ -285,7 +285,7 @@ and step-up authentication (when the server returns `insufficient_scope` error).
 ## Security
 
 Here we discuss the mitigations described under
-the MCP spec's [Security Best Practices](https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices) section, and how we handle them.
+the MCP's [Security Best Practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices) section, and how we handle them.
 
 ### Confused Deputy