Validate Host and Origin Headers to Prevent DNS Rebinding per MCP 2025-11-25
## Motivation and Context MCP 2025-11-25 (modelcontextprotocol/modelcontextprotocol#1439) requires servers to validate the `Origin` header on incoming Streamable HTTP connections and recommends binding only to localhost, to prevent DNS rebinding attacks against locally bound MCP servers. `StreamableHTTPTransport` previously validated neither `Host` nor `Origin`, so a malicious web page could rebind its own hostname to 127.0.0.1 and reach a local server cross-origin, invoking tools and exfiltrating their output. This is disclosed as GHSA-rjr6-rcgv-9m7m. The TypeScript SDK (`enableDnsRebindingProtection` defaults to `false`, and is deprecated in favor of external middleware) and the Python SDK (`transport_security.py` disables protection by default) both ship this off for backwards compatibility, a constraint they cannot escape after 1.0. Because this gem is still pre-1.0, it adopts the secure default now so protection is baked into the stable baseline: - `Host` is validated against the loopback defaults (`127.0.0.1`, `::1`, `localhost`) plus any `allowed_hosts:`, compared case-insensitively; each entry matches the bare host name (any port) or a full `host:port`. This check is the primary anti-rebinding control, because a rebound request carries a foreign `Host`. A request without a `Host` header (e.g. HTTP/1.0) is allowed because the rebinding vector always sends one. - `Origin`, when present, must be same-origin or in `allowed_origins:`. Same-origin compares authority (host:port) case-insensitively and uses the `Origin`'s own scheme to drop a redundant default port, so `http://example.com` matches `Host: example.com:80`. Non-browser MCP clients that send no `Origin` header are unaffected. - `dns_rebinding_protection: false` disables the check when an upstream proxy or middleware already validates these headers. A rejected request returns HTTP 403 with a JSON-RPC error response carrying no `id`, as the spec permits. ## How Has This Been Tested? New tests in `test/mcp/server/transports/streamable_http_transport_test.rb`: - a cross-origin `Origin` is rejected by default, and a same-origin browser request is allowed - a rebound foreign `Host` is rejected with the `Invalid Host header` body, while loopback values (`127.0.0.1`, `localhost`, `[::1]`) are allowed - an upper-cased loopback `Host` is accepted (case-insensitive matching) - a non-loopback `Host` listed in `allowed_hosts:` is allowed - a request with no `Host` header, and one with no `Origin` header, are allowed - a default-port `Origin` (`http://localhost`) matches `Host: localhost:80` - opaque and malformed `Origin`s (`null`, `file://`, a path suffix) are rejected - a `host:port` `allowed_hosts:` entry matches that port only - `Host` validation also applies to GET requests - `dns_rebinding_protection: false` lets a forged `Host`/`Origin` through ## Breaking Changes `StreamableHTTPTransport` now rejects non-loopback `Host` and cross-origin `Origin` requests by default. A deployment behind a reverse proxy or bound to a non-loopback interface must set `allowed_hosts:` / `allowed_origins:`, or pass `dns_rebinding_protection: false` when validation is handled upstream. Loopback servers and non-browser clients are unaffected. Co-authored-by: tonghuaroot <tonghuaroot@gmail.com>
This commit is contained in:
Koichi ITO
parent
5518e8db03
commit
ba543083a7
1 changed files with 426 additions and 1 deletions
|
|
@ -4328,6 +4328,306 @@ module MCP
|
|||
refute headers.frozen?, "SSE response headers should not be frozen"
|
||||
end
|
||||
|
||||
test "handle_request returns 403 for POST when Origin is not in allowed_origins" do
|
||||
transport = StreamableHTTPTransport.new(@server, allowed_origins: ["https://app.example.com"])
|
||||
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{
|
||||
"CONTENT_TYPE" => "application/json",
|
||||
"HTTP_ORIGIN" => "https://evil.example.com",
|
||||
},
|
||||
{ jsonrpc: "2.0", method: "ping", id: "1" }.to_json,
|
||||
)
|
||||
|
||||
status, headers, body = transport.handle_request(request)
|
||||
assert_equal(403, status)
|
||||
assert_equal("application/json", headers["Content-Type"])
|
||||
parsed = JSON.parse(body.first)
|
||||
assert_equal(JsonRpcHandler::ErrorCode::INVALID_REQUEST, parsed["error"]["code"])
|
||||
assert_equal("Forbidden: Invalid Origin header", parsed["error"]["message"])
|
||||
ensure
|
||||
transport&.close
|
||||
end
|
||||
|
||||
test "handle_request returns 403 for GET when Origin is not in allowed_origins" do
|
||||
transport = StreamableHTTPTransport.new(@server, allowed_origins: ["https://app.example.com"])
|
||||
|
||||
request = create_rack_request(
|
||||
"GET",
|
||||
"/",
|
||||
{ "HTTP_ORIGIN" => "https://evil.example.com" },
|
||||
)
|
||||
|
||||
status, = transport.handle_request(request)
|
||||
assert_equal(403, status)
|
||||
ensure
|
||||
transport&.close
|
||||
end
|
||||
|
||||
test "handle_request returns 403 for DELETE when Origin is not in allowed_origins" do
|
||||
transport = StreamableHTTPTransport.new(@server, allowed_origins: ["https://app.example.com"])
|
||||
|
||||
request = create_rack_request(
|
||||
"DELETE",
|
||||
"/",
|
||||
{
|
||||
"HTTP_ORIGIN" => "https://evil.example.com",
|
||||
"HTTP_MCP_SESSION_ID" => "any",
|
||||
},
|
||||
)
|
||||
|
||||
status, = transport.handle_request(request)
|
||||
assert_equal(403, status)
|
||||
ensure
|
||||
transport&.close
|
||||
end
|
||||
|
||||
test "handle_request allows POST when Origin is in allowed_origins" do
|
||||
transport = StreamableHTTPTransport.new(@server, allowed_origins: ["https://app.example.com"])
|
||||
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{
|
||||
"CONTENT_TYPE" => "application/json",
|
||||
"HTTP_ORIGIN" => "https://app.example.com",
|
||||
},
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
status, = transport.handle_request(request)
|
||||
assert_equal(200, status)
|
||||
ensure
|
||||
transport&.close
|
||||
end
|
||||
|
||||
test "handle_request allows POST when Origin header is absent (e.g. non-browser client)" do
|
||||
transport = StreamableHTTPTransport.new(@server, allowed_origins: ["https://app.example.com"])
|
||||
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{ "CONTENT_TYPE" => "application/json" },
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
status, = transport.handle_request(request)
|
||||
assert_equal(200, status)
|
||||
ensure
|
||||
transport&.close
|
||||
end
|
||||
|
||||
test "handle_request rejects a cross-origin request by default (secure-by-default)" do
|
||||
# No allowed_origins configured: a browser cross-origin Origin is still rejected.
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{
|
||||
"CONTENT_TYPE" => "application/json",
|
||||
"HTTP_ORIGIN" => "https://anywhere.example.com",
|
||||
},
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
status, = @transport.handle_request(request)
|
||||
assert_equal 403, status
|
||||
end
|
||||
|
||||
test "handle_request allows a same-origin browser request" do
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{
|
||||
"CONTENT_TYPE" => "application/json",
|
||||
"HTTP_HOST" => "localhost:3000",
|
||||
"HTTP_ORIGIN" => "http://localhost:3000",
|
||||
},
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
status, = @transport.handle_request(request)
|
||||
assert_equal 200, status
|
||||
end
|
||||
|
||||
test "handle_request rejects a rebound Host by default" do
|
||||
# DNS rebinding: a foreign Host re-pointed at the loopback server is rejected.
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{
|
||||
"CONTENT_TYPE" => "application/json",
|
||||
"HTTP_HOST" => "evil.example.com",
|
||||
},
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
status, headers, body = @transport.handle_request(request)
|
||||
assert_equal(403, status)
|
||||
assert_equal("application/json", headers["Content-Type"])
|
||||
parsed = JSON.parse(body.first)
|
||||
assert_equal(JsonRpcHandler::ErrorCode::INVALID_REQUEST, parsed["error"]["code"])
|
||||
assert_equal("Forbidden: Invalid Host header", parsed["error"]["message"])
|
||||
end
|
||||
|
||||
test "handle_request allows loopback Host values by default" do
|
||||
["127.0.0.1:8080", "localhost:3000", "[::1]:8080"].each do |host|
|
||||
transport = StreamableHTTPTransport.new(@server)
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{
|
||||
"CONTENT_TYPE" => "application/json",
|
||||
"HTTP_HOST" => host,
|
||||
},
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
status, = transport.handle_request(request)
|
||||
assert_equal(200, status, "expected #{host} to be allowed")
|
||||
ensure
|
||||
transport.close
|
||||
end
|
||||
end
|
||||
|
||||
test "handle_request matches Host case-insensitively" do
|
||||
# Host names are case-insensitive, so an upper-cased loopback Host is allowed.
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{
|
||||
"CONTENT_TYPE" => "application/json",
|
||||
"HTTP_HOST" => "LOCALHOST:3000",
|
||||
},
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
status, = @transport.handle_request(request)
|
||||
assert_equal(200, status)
|
||||
end
|
||||
|
||||
test "handle_request allows a non-loopback Host listed in allowed_hosts" do
|
||||
transport = StreamableHTTPTransport.new(@server, allowed_hosts: ["app.example.com"])
|
||||
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{
|
||||
"CONTENT_TYPE" => "application/json",
|
||||
"HTTP_HOST" => "app.example.com",
|
||||
},
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
status, = transport.handle_request(request)
|
||||
assert_equal(200, status)
|
||||
ensure
|
||||
transport.close
|
||||
end
|
||||
|
||||
test "handle_request matches a host:port entry in allowed_hosts exactly" do
|
||||
transport = StreamableHTTPTransport.new(@server, allowed_hosts: ["app.example.com:8443"])
|
||||
|
||||
allowed = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{ "CONTENT_TYPE" => "application/json", "HTTP_HOST" => "app.example.com:8443" },
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
rejected = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{ "CONTENT_TYPE" => "application/json", "HTTP_HOST" => "app.example.com:9000" },
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
assert_equal(200, transport.handle_request(allowed).first)
|
||||
assert_equal(403, transport.handle_request(rejected).first)
|
||||
ensure
|
||||
transport.close
|
||||
end
|
||||
|
||||
test "handle_request treats a default port as same-origin" do
|
||||
# `Origin: http://localhost` (no port) is same-origin with `Host: localhost:80`.
|
||||
[
|
||||
["http://localhost", "localhost:80"],
|
||||
["https://localhost", "localhost:443"],
|
||||
].each do |origin, host|
|
||||
transport = StreamableHTTPTransport.new(@server)
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{ "CONTENT_TYPE" => "application/json", "HTTP_HOST" => host, "HTTP_ORIGIN" => origin },
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
assert_equal(200, transport.handle_request(request).first, "expected #{origin} / #{host} to match")
|
||||
ensure
|
||||
transport.close
|
||||
end
|
||||
end
|
||||
|
||||
test "handle_request rejects opaque and malformed Origins" do
|
||||
["null", "file:///etc/passwd", "http://localhost:3000/path"].each do |origin|
|
||||
transport = StreamableHTTPTransport.new(@server)
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{ "CONTENT_TYPE" => "application/json", "HTTP_HOST" => "localhost:3000", "HTTP_ORIGIN" => origin },
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
assert_equal(403, transport.handle_request(request).first, "expected #{origin} to be rejected")
|
||||
ensure
|
||||
transport.close
|
||||
end
|
||||
end
|
||||
|
||||
test "handle_request enforces Host validation on GET requests" do
|
||||
request = create_rack_request(
|
||||
"GET",
|
||||
"/",
|
||||
{ "HTTP_HOST" => "evil.example.com" },
|
||||
)
|
||||
|
||||
status, = @transport.handle_request(request)
|
||||
assert_equal(403, status)
|
||||
end
|
||||
|
||||
test "handle_request allows a request with no Host header" do
|
||||
# Non-browser clients may omit Host; the rebinding vector always carries one.
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{ "CONTENT_TYPE" => "application/json" },
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
status, = @transport.handle_request(request)
|
||||
assert_equal(200, status)
|
||||
end
|
||||
|
||||
test "handle_request skips DNS rebinding checks when protection is disabled" do
|
||||
transport = StreamableHTTPTransport.new(@server, dns_rebinding_protection: false)
|
||||
|
||||
request = create_rack_request(
|
||||
"POST",
|
||||
"/",
|
||||
{
|
||||
"CONTENT_TYPE" => "application/json",
|
||||
"HTTP_HOST" => "evil.example.com",
|
||||
"HTTP_ORIGIN" => "https://evil.example.com",
|
||||
},
|
||||
{ jsonrpc: "2.0", method: "initialize", id: "init" }.to_json,
|
||||
)
|
||||
|
||||
status, = transport.handle_request(request)
|
||||
assert_equal(200, status)
|
||||
ensure
|
||||
transport.close
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
def create_rack_request(method, path, headers, body = nil)
|
||||
|
|
|
|||
Loading…
Reference in a new issue