`createMcpExpressApp` / `createMcpHonoApp`: non-loopback `host` silently skips Host/Origin checks (only `0.0.0.0`/`::` warn) |

Abierto Apto para principiantes

#2,843 abierto el 22/9/2026 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad: 2/5
Tiempo estimado: 1-3 horas
Aptitud para principiantes: 65/100

Tipo de issue: Error
Claridad: Bien especificado
Estado de actividad: Activo
Stack tecnológico: node.js, typescript
Área: backend-api-design, security

Línea de trabajo

El problema está en packages/middleware/express/src/express.ts y packages/middleware/hono/src/hono.ts. Examina la lógica que añade el middleware localhostHostValidation y registra advertencias. La tarea es extender la advertencia o validación a hosts que no sean de loopback, como '192.168.1.10'. Comprueba cómo se utilizan las opciones allowedHosts y allowedOrigins. Una prueba debe verificar que la advertencia aparece o que la validación se aplica para un host que no sea de loopback.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

v1 v2

Static review of public source at commit 603217008710. No traffic was sent to any MCP environment.

createMcpExpressApp (and the matching Hono helper) auto-arm Host + Origin validation only for loopback hosts. Binding to 0.0.0.0 / :: logs a warning, but any other non-loopback host (LAN IP, container hostname, public DNS name) gets neither middleware nor that warning:

packages/middleware/express/src/express.ts (same ladder in packages/middleware/hono/src/hono.ts):

const localhostHosts = ['127.0.0.1', 'localhost', '::1'];
if (localhostHosts.includes(host)) {
    app.use(localhostHostValidation());
} else if (host === '0.0.0.0' || host === '::') {
    console.warn(
        `Warning: Server is binding to ${host} without DNS rebinding protection. ` +
            'Consider using the allowedHosts option...'
    );
}
// Origin: only armed for loopback or explicit allowedOrigins

So createMcpExpressApp({ host: '192.168.1.10' }) or { host: 'mcp.internal' } serves without Host/Origin checks and without the operator nudge that 0.0.0.0 already gets. DNS rebinding / browser-origin abuse is exactly what those middleware exist for on HTTP MCP endpoints.

Suggested change:

Treat every non-loopback host like 0.0.0.0: require allowedHosts (and ideally allowedOrigins), or at least emit the same warning.
Or fail closed: refuse to construct the app for non-loopback binds unless allowlists are provided.
Keep the explicit opt-out path for demos that truly need an open bind.

Severity: medium as insecure default / defense-in-depth for non-loopback HTTP mounts; not claiming a working exploit against a specific deployment. No proof-of-concept.

Happy to send a focused PR if this direction is useful.