From 6a81e5da2a3581e14bf2709dbdf88342d582f8d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Theodor=20Nesfeldt=20Eng=C3=B8y?= <140903820+TheodorNEngoy@users.noreply.github.com> Date: Wed, 11 Feb 2026 10:02:17 +0100 Subject: [PATCH] examples: bind auth-middleware server to localhost by default (#784) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The auth-middleware example currently defaults to `-http :8080`, which binds to all interfaces (LAN-exposed) by default. This changes the default to `localhost:8080` and adds a short comment noting `-http 0.0.0.0:8080` if you intentionally want to expose it. Rationale: this example serves token-generation endpoints and authenticated MCP routes; binding loopback by default avoids accidental exposure while keeping the opt-in remote behavior. --------- Co-authored-by: Theodor N. Engøy Co-authored-by: Theodor N. Engøy --- examples/server/auth-middleware/main.go | 4 +++- scripts/server-conformance.sh | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/examples/server/auth-middleware/main.go b/examples/server/auth-middleware/main.go index ca339df..f9ac34f 100644 --- a/examples/server/auth-middleware/main.go +++ b/examples/server/auth-middleware/main.go @@ -26,7 +26,9 @@ import ( // This example demonstrates how to integrate auth.RequireBearerToken middleware // with an MCP server to provide authenticated access to MCP tools and resources. -var httpAddr = flag.String("http", ":8080", "HTTP address to listen on") +// Default to loopback to avoid exposing powerful demo endpoints to the local network. +// Set -http 0.0.0.0:8080 to intentionally expose it. +var httpAddr = flag.String("http", "localhost:8080", "HTTP address to listen on") // JWTClaims represents the claims in our JWT tokens. // In a real application, you would include additional claims like issuer, audience, etc. diff --git a/scripts/server-conformance.sh b/scripts/server-conformance.sh index 0826086..f31d8df 100755 --- a/scripts/server-conformance.sh +++ b/scripts/server-conformance.sh @@ -70,8 +70,8 @@ fi go build -o "$WORKDIR/conformance-server" ./conformance/everything-server # Start the server in the background -echo "Starting conformance server on port $PORT..." -"$WORKDIR/conformance-server" -http=":$PORT" & +echo "Starting conformance server on localhost:$PORT..." +"$WORKDIR/conformance-server" -http="localhost:$PORT" & SERVER_PID=$! echo "Server pid is $SERVER_PID"