Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Warn on non-loopback web binds and document the token's access-control boundary in the README

Abierto
  • ¿Algo no está bien?
#2,750 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
67/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
typescript
Área
backend, documentation, security

Línea de trabajo

Start with the “Hosting on a network” section in clients/web/README.md and the bind resolution in clients/web/server/resolve-bind-host.ts; then trace startup output in the launcher and Docker image. Check the existing tests around bind resolution and add coverage for loopback names and IPs staying silent and other hosts warning. Done when the README and both startup outputs explain the token boundary consistently and the warning tests pass.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement v2

Problem

The web server's API token protects against cross-origin browser requests. It is not access control against anyone who can load the UI: GET / hands the token to whoever can reach the page. docs/docker.md says so, and says that publishing more widely needs a real access-control boundary in front. Two gaps remain:

  1. The web README's "Hosting on a network" section (clients/web/README.md) doesn't carry that warning.
  2. A non-loopback bind prints no warning. A wildcard bind requires DANGEROUSLY_BIND_ALL_INTERFACES, but HOST=<specific LAN or public IP> (clients/web/server/resolve-bind-host.ts) is accepted silently.

Proposed change

  • Add the access-control caveat to "Hosting on a network": anyone who can load the page can act as the user, and that includes other local users on a shared host.
  • At startup, when the resolved bind host is not loopback, print a one-time warning to the same effect, with a link to the README section. Keep the launcher banner and the Docker image's output consistent; the image binds 0.0.0.0 by design.
  • Tests for the warning's trigger (loopback names and IPs stay silent; anything else warns).

Possible follow-up (not this issue)

A bootstrap that never puts the token in HTML, such as a one-time secret in the URL fragment exchanged for an HttpOnly cookie, would remove the "anyone who loads the page" property. That's a design change across the launcher, the server and the deep-link flow, and it deserves its own issue if we pursue it.

Priority score

Severity 2, Urgency 3, +1 milestone, Total 6 → Medium.

Lenguaje dominante
TypeScript
Estrellas
11.1k
Forks
1.6k
Merge medio
5 h 29 min
PR fusionados (30 d)
158

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de modelcontextprotocol/inspector

Todos los issues de modelcontextprotocol/inspector

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.