From 7e93a9fc19078f4fc804d617bec780c012404f53 Mon Sep 17 00:00:00 2001 From: Peter Alexander Date: Mon, 22 Sep 2025 16:44:51 +0100 Subject: [PATCH] Return HTTP 403 for invalid Origin headers (#1353) --- src/mcp/server/transport_security.py | 2 +- tests/server/test_sse_security.py | 2 +- tests/server/test_streamable_http_security.py | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/mcp/server/transport_security.py b/src/mcp/server/transport_security.py index 3a884ee2..de4542af 100644 --- a/src/mcp/server/transport_security.py +++ b/src/mcp/server/transport_security.py @@ -122,6 +122,6 @@ class TransportSecurityMiddleware: # Validate Origin header origin = request.headers.get("origin") if not self._validate_origin(origin): - return Response("Invalid Origin header", status_code=400) + return Response("Invalid Origin header", status_code=403) return None diff --git a/tests/server/test_sse_security.py b/tests/server/test_sse_security.py index 43af3506..bdaec6bd 100644 --- a/tests/server/test_sse_security.py +++ b/tests/server/test_sse_security.py @@ -127,7 +127,7 @@ async def test_sse_security_invalid_origin_header(server_port: int): async with httpx.AsyncClient() as client: response = await client.get(f"http://127.0.0.1:{server_port}/sse", headers=headers) - assert response.status_code == 400 + assert response.status_code == 403 assert response.text == "Invalid Origin header" finally: diff --git a/tests/server/test_streamable_http_security.py b/tests/server/test_streamable_http_security.py index eed79192..b9cd83dc 100644 --- a/tests/server/test_streamable_http_security.py +++ b/tests/server/test_streamable_http_security.py @@ -155,7 +155,7 @@ async def test_streamable_http_security_invalid_origin_header(server_port: int): json={"jsonrpc": "2.0", "method": "initialize", "id": 1, "params": {}}, headers=headers, ) - assert response.status_code == 400 + assert response.status_code == 403 assert response.text == "Invalid Origin header" finally: