modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Modify Origin header validation in validateRequestHeaders (streamableHttp.ts and sse.ts) to allow requests without an Origin, as they are not relevant to server DNS rebinding protection. (#1205)

Browse source
This commit is contained in:
Jacopo Cappellato 2025-12-02 10:56:09 +01:00 • committed by GitHub
commit 608360047d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 46 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/server/sse.test.ts
View file

@ -547,6 +547,27 @@ describe.each(zodTestMatrix)('$zodVersionLabel', (entry: ZodMatrixEntry) => {
expect(mockHandleRes.end).toHaveBeenCalledWith('Accepted');
});
it('should accept requests without origin headers', async () => {
const mockRes = createMockResponse();
const transport = new SSEServerTransport('/messages', mockRes, {
allowedOrigins: ['http://localhost:3000', 'https://example.com'],
enableDnsRebindingProtection: true
});
await transport.start();
const mockReq = createMockRequest({
headers: {
'content-type': 'application/json'
}
});
const mockHandleRes = createMockResponse();
await transport.handlePostMessage(mockReq, mockHandleRes, { jsonrpc: '2.0', method: 'test' });
expect(mockHandleRes.writeHead).toHaveBeenCalledWith(202);
expect(mockHandleRes.end).toHaveBeenCalledWith('Accepted');
});
it('should reject requests with disallowed origin headers', async () => {
const mockRes = createMockResponse();
const transport = new SSEServerTransport('/messages', mockRes, {