Explicit default-port Origin entries reject browser-serialized origins
@DaleSeo ya está trabajando en esto.
Desde el 14/9/2026.
Evaluación
Este issue todavía no se ha evaluado.
Descripción
Configuring StreamableHttpServerConfig::allowed_origins with https://client.example:443 rejects Origin: https://client.example with HTTP 403. Supplying Origin: https://client.example:443 succeeds. This prevents an explicit default-port entry from matching the origin’s normal browser serialization.
Reproduced with rmcp 3.3.0 through a Streamable HTTP server, using MCP Inspector CLI to call a tool with each Origin header explicitly supplied:
| Allowed entry | Request Origin | Observed | Expected |
|---|---|---|---|
https://client.example:443 |
https://client.example |
HTTP 403 | Accepted |
https://client.example:443 |
https://client.example:443 |
Accepted | Accepted |
https://client.example:443 |
https://client.example:8443 |
HTTP 403 | HTTP 403 |
https://client.example |
https://client.example:8443 |
Accepted | Accepted |
RFC 6454 §4 assigns an omitted port the scheme’s default; §6.2 omits that default port when serializing an origin. The current matcher instead compares the incoming absent port directly against the configured explicit port.
Please compare an explicitly configured port against the incoming origin’s effective port: 443 for HTTPS and 80 for HTTP when omitted. Preserve the existing rule that an omitted configured port permits any port. This makes default-port restrictions work through the existing configuration while retaining the wildcard behavior that Spice intentionally uses.
The rustdoc should describe that distinction: an omitted configured port permits any port; an explicit configured port restricts matching to that effective port. This preserves the omitted-port policy left unchanged by #1191 and #1192.
- Lenguaje dominante
- Rust
- Estrellas
- 3.9k
- Forks
- 645
- Merge medio
- 4 d 22 h
- PR fusionados (30 d)
- 37
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de modelcontextprotocol/rust-sdk
-
streamable-http server: a supplied Mcp-Method contradicting an initialize body is silently accepted Abiertobug P1 ready for work T-transport
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
modelcontextprotocol/rust-sdk#1271 ·
-
bug P2 ready for work T-model
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
modelcontextprotocol/rust-sdk#1242 ·
-
P3 question T-documentation T-enhancement
Dificultad 1/5 Menos de una hora Aptitud para principiantes 86/100
modelcontextprotocol/rust-sdk#1155 ·
-
bug P1 ready for work T-model T-service
Dificultad 3/5 1-2 días Aptitud para principiantes 72/100
modelcontextprotocol/rust-sdk#1283 · 1 comentario ·
-
bug P0 ready for work T-security T-transport
modelcontextprotocol/rust-sdk#1272 · 1 asignado ·
Todos los issues de modelcontextprotocol/rust-sdk
Issues similares
-
bug github_actions
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
registrystack/registry-stack#1393 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
longbridge/gpui-kit#3223 ·
-
bug engine
Dificultad 2/5 1-3 horas Aptitud para principiantes 65/100
rocky-data/rocky#2181 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 70/100
oasisprotocol/oasis-sdk#2523 ·
-
[indexer] [QA] Add a focused test for the new NonRetryableError / assertSocketAlive() behavior. Abiertobot:ai-assisted component:indexer QA-roadmap status:untriaged
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
midnightntwrk/midnight-indexer#1557 ·