modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

mcp: verify 'Origin' and 'Content-Type' headers (#842)

Browse source 
This PR introduces protection against cross-origin requests by
installing `http.CrossOriginProtection`.
By default, the zero value is used which does not contain any trusted
origins or bypass patterns.
The protection can be customized by providing a custom
`http.CrossOriginProtection` in `mcp.StreamableHTTPOptions`. Currently,
the deny handler set on the protection is ignored.
This default has an MCPGODEBUG option (`disableoriginverification`) to
disable the default protection.
It will be available until `v1.6.0` of the SDK.
We also increase the Go version required by the SDK to 1.25, since this
is the version that introduced `http.CrossOriginProtection`. This is in
line with the SDK's policy of supporting two newest Go versions (1.26
was released in February 2026).

Additionally, we start validating if the `Content-Type` header for
`POST` requests is set to `application/json` to avoid accepting
CORS-safelisted requests.
This commit is contained in:
Maciej Kisiel 2026-03-13 11:36:41 +01:00 • committed by Maciek Kisiel
commit 580f2a09be
No known key found for this signature in database
1 changed files with 252 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

40
internal/docs/mcpgodebug.src.md Normal file
View file

@ -0,0 +1,40 @@
# Backwards compatibility and MCPGODEBUG
According to our compatibility promise, we can't break backward compatibility
of the SDK API. However, sometimes we need to change the behavior of the SDK
in a backward-incompatible way in order to fix bugs or security issues.
In those cases we introduce temporary compatibility parameters, that can be
used to opt-out of the new behavior. They are usually maintained for two
minor release cycles and then removed.
The compatibility parameters are provided via the `MCPGODEBUG` environment
variable. The value of the variable is a comma-separated list of parameter
value assignments, e.g.:
```
MCPGODEBUG=parameter1=value1,parameter2=value2
```
## `MCPGODEBUG` history
### 1.4.1
Options listed below will be removed in the 1.6.0 version of the SDK.
- `disablecrossoriginprotection` added. If set to `1`, newly added cross-origin
protection will be disabled. The default behavior was changed to enable
cross-origin protection.
### 1.4.0
Options listed below will be removed in the 1.6.0 version of the SDK.
- `jsonescaping` added. If set to `1`, JSON marshaling will preserve the previous
behavior of escaping HTML characters in JSON strings. The default behavior
was changed to not escape HTML characters, to be consistent with other SDKs.
- `disablelocalhostprotection` added. If set to `1`, newly added DNS rebinding
protection will be disabled. The default behavior was changed to enable DNS rebinding
protection. The protection can also be disabled by setting the
`DisableLocalhostProtection` field in the `StreamableHTTPOptions` struct to
`true`, which is the recommended way to disable the protection long term.