Explicit default-port Origin entries reject browser-serialized origins
@DaleSeo is already working on this.
Since Sep 14, 2026.
Assessment
This issue has not been assessed yet.
Description
Configuring StreamableHttpServerConfig::allowed_origins with https://client.example:443 rejects Origin: https://client.example with HTTP 403. Supplying Origin: https://client.example:443 succeeds. This prevents an explicit default-port entry from matching the origin’s normal browser serialization.
Reproduced with rmcp 3.3.0 through a Streamable HTTP server, using MCP Inspector CLI to call a tool with each Origin header explicitly supplied:
| Allowed entry | Request Origin | Observed | Expected |
|---|---|---|---|
https://client.example:443 |
https://client.example |
HTTP 403 | Accepted |
https://client.example:443 |
https://client.example:443 |
Accepted | Accepted |
https://client.example:443 |
https://client.example:8443 |
HTTP 403 | HTTP 403 |
https://client.example |
https://client.example:8443 |
Accepted | Accepted |
RFC 6454 §4 assigns an omitted port the scheme’s default; §6.2 omits that default port when serializing an origin. The current matcher instead compares the incoming absent port directly against the configured explicit port.
Please compare an explicitly configured port against the incoming origin’s effective port: 443 for HTTPS and 80 for HTTP when omitted. Preserve the existing rule that an omitted configured port permits any port. This makes default-port restrictions work through the existing configuration while retaining the wildcard behavior that Spice intentionally uses.
The rustdoc should describe that distinction: an omitted configured port permits any port; an explicit configured port restricts matching to that effective port. This preserves the omitted-port policy left unchanged by #1191 and #1192.
- Dominant language
- Rust
- Stars
- 3.9k
- Forks
- 645
- Avg merge
- 4d 13h
- Merged PRs (30d)
- 36
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from modelcontextprotocol/rust-sdk
-
streamable-http server: a supplied Mcp-Method contradicting an initialize body is silently accepted Openbug P1 ready for work T-transport
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
modelcontextprotocol/rust-sdk#1271 ·
-
bug P2 ready for work T-model
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
modelcontextprotocol/rust-sdk#1242 ·
-
P3 question T-documentation T-enhancement
Difficulty 1/5 Under an hour Newbie friendliness 86/100
modelcontextprotocol/rust-sdk#1155 ·
-
bug P1 ready for work T-model T-service
Difficulty 3/5 1-2 days Newbie friendliness 72/100
modelcontextprotocol/rust-sdk#1283 · 1 comment ·
-
bug P0 ready for work T-security T-transport
modelcontextprotocol/rust-sdk#1272 · 1 assignee ·
All issues in modelcontextprotocol/rust-sdk
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·
-
bug triage:deciding
Difficulty 1/5 Under an hour Newbie friendliness 88/100
open-telemetry/otel-arrow#4132 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100