modelcontextprotocol/python-sdk
Watch
1
0
Fork
You've already forked python-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Return HTTP 403 for invalid Origin headers (#1353)

Browse source
This commit is contained in:
Peter Alexander 2025-09-22 16:44:51 +01:00 • committed by GitHub
commit 7e93a9fc19
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/mcp/server/transport_security.py
View file

@ -122,6 +122,6 @@ class TransportSecurityMiddleware:
# Validate Origin header # Validate Origin header
origin = request.headers.get("origin") origin = request.headers.get("origin")
if not self._validate_origin(origin): if not self._validate_origin(origin):
return Response("Invalid Origin header", status_code=400) return Response("Invalid Origin header", status_code=403)
return None return None

2
tests/server/test_sse_security.py
View file

@ -127,7 +127,7 @@ async def test_sse_security_invalid_origin_header(server_port: int):
async with httpx.AsyncClient() as client: async with httpx.AsyncClient() as client:
response = await client.get(f"http://127.0.0.1:{server_port}/sse", headers=headers) response = await client.get(f"http://127.0.0.1:{server_port}/sse", headers=headers)
assert response.status_code == 400 assert response.status_code == 403
assert response.text == "Invalid Origin header" assert response.text == "Invalid Origin header"
finally: finally:

2
tests/server/test_streamable_http_security.py
View file

@ -155,7 +155,7 @@ async def test_streamable_http_security_invalid_origin_header(server_port: int):
json={"jsonrpc": "2.0", "method": "initialize", "id": 1, "params": {}}, json={"jsonrpc": "2.0", "method": "initialize", "id": 1, "params": {}},
headers=headers, headers=headers,
) )
assert response.status_code == 400 assert response.status_code == 403
assert response.text == "Invalid Origin header" assert response.text == "Invalid Origin header"
finally: finally: