Update conformance tests with DNS rebinding protection

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>

conformance-tests/VALIDATION_RESULTS.md

@@ -15,13 +15,12 @@
 - **Resources (4/6):** list, read-text, read-binary, templates-read
 - **Prompts (4/4):** list, simple, with-args, embedded-resource, with-image
 - **SSE Transport (2/2):** Multiple streams
-- **Security (1/2):** Localhost validation passes
+- **Security (2/2):** Localhost validation passes, DNS rebinding protection
 
 ### Failing (3/40)
 
 1. **resources-subscribe** - Not implemented in SDK
 2. **resources-unsubscribe** - Not implemented in SDK  
-3. **dns-rebinding-protection** - Missing Host/Origin validation (1/2 checks)
 
 ## Client Test Results
 
@@ -44,7 +43,6 @@
 
 1. **Resource Subscriptions:** SDK doesn't implement `resources/subscribe` and `resources/unsubscribe` handlers
 2. **Client SSE Retry:** Client doesn't parse or respect the `retry:` field, reconnects immediately, and doesn't send Last-Event-ID header
-3. **DNS Rebinding Protection:** Missing Host/Origin header validation in server transport
 
 ## Running Tests
 

conformance-tests/conformance-baseline.yml

@@ -7,9 +7,6 @@ server:
   - resources-subscribe
   - resources-unsubscribe
 
-  # DNS rebinding protection missing Host/Origin validation
-  - dns-rebinding-protection
-
 client:
   # SSE retry field handling not implemented
   # - Client does not parse or respect retry: field timing

conformance-tests/server-servlet/README.md

@@ -32,8 +32,8 @@ The server has been validated against the official [MCP conformance test suite](
 ✅ **SSE Transport** (2/2)
 - Multiple streams support
 
-⚠️ **Security** (1/2)
+✅ **Security** (2/2)
-- ⚠️ DNS rebinding protection (SDK limitation)
+- ✅ DNS rebinding protection
 
 ## Features
 

conformance-tests/server-servlet/src/main/java/io/modelcontextprotocol/conformance/server/ConformanceServlet.java

@@ -7,6 +7,7 @@ import java.util.Map;
 
 import io.modelcontextprotocol.server.McpServer;
 import io.modelcontextprotocol.server.McpServerFeatures;
+import io.modelcontextprotocol.server.transport.DefaultServerTransportSecurityValidator;
 import io.modelcontextprotocol.server.transport.HttpServletStreamableServerTransportProvider;
 import io.modelcontextprotocol.spec.McpSchema.AudioContent;
 import io.modelcontextprotocol.spec.McpSchema.BlobResourceContents;
@@ -66,6 +67,8 @@ public class ConformanceServlet {
 			.builder()
 			.mcpEndpoint(MCP_ENDPOINT)
 			.keepAliveInterval(Duration.ofSeconds(30))
+			.securityValidator(
+					DefaultServerTransportSecurityValidator.builder().allowedOrigin("http://localhost:*").build())
 			.build();
 
 		// Build server with all conformance test features