Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

dns-rebinding-protection: check Host and Origin validation separately

Đang mở
  • Có gì không ổn?
#535 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 4 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
3/5
Thời gian dự kiến
1-2 ngày
Mức phù hợp với người mới
45/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
typescript
Lĩnh vực
security, testing-qa

Hướng nghiên cứu

Start with the commented constants in src/scenarios/server/dns-rebinding.ts and the existing dns-rebinding-protection checks. Read the fixture files dns-rebinding-host-only.ts, dns-rebinding-origin-only.ts, and no-dns-rebinding-protection.ts, then inspect negative.test.ts. Done means Host-only and Origin-only requests are checked separately, the fixture schema issue is corrected, and the listed server results are asserted.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

enhancement

Gap

localhost-host-rebinding-rejected sends Host: evil.example.com and Origin: http://evil.example.com in the same request and passes on any 4xx. A server that validates only one of the two headers passes it.

The two headers are separate defenses:

  • Host is wrong on every rebound request, including the same-origin GET that opens the SSE stream, which carries no Origin. The SDK advisories (GHSA-w48q-cv73-mx4w, GHSA-9h52-p55h-vw2f) were fixed by validating Host on localhost.
  • Origin is what the transport spec requires, with a fixed status code.

So the scenario cannot tell whether a server meets the Origin MUST, and it cannot tell whether a server validates Host.

Example: the everything-server in this repo uses createMcpExpressApp() from @modelcontextprotocol/sdk 1.29, which validates Host only. With a localhost Host and Origin: http://evil.example.com it returns 200, and it passes the current scenario 2/2.

Spec text

Streamable HTTP, draft ("Security & Endpoint"), and the same wording in 2025-11-25 ("Security Warning"):

  1. Servers MUST validate the Origin header on all incoming connections to prevent DNS rebinding attacks.
    • If the Origin header is present and invalid, servers MUST respond with HTTP 403 Forbidden. The HTTP response body MAY comprise a JSON-RPC error response that has no id.

The 403 sentence came from modelcontextprotocol/modelcontextprotocol#1439. No spec text requires Host validation.

Proposal

Add two checks to the existing dns-rebinding-protection scenario. No new scenario. localhost-host-rebinding-rejected and localhost-host-valid-accepted keep their ids and behavior.

Check Request Pass Miss
localhost-host-only-rebinding-rejected Host: evil.example.com, no Origin any 4xx WARNING
localhost-origin-only-rebinding-rejected localhost Host, Origin: http://evil.example.com exactly 403 FAILURE

The Origin check is FAILURE because both sentences above are MUST. The Host check is WARNING because there is no spec keyword behind it. If you would rather it be FAILURE (the scenario text already says "MUST validate the Host or Origin header") or INFO, that is a one-line change.

modelcontextprotocol/modelcontextprotocol#3370

#3370 (open, labeled bug) proposes changing this text: Host validation MUST for servers that grant access by network position, Origin validation MUST only when ambient credentials are accepted and SHOULD otherwise, 403 unchanged when a server does validate Origin. As of 2026-09-27 it has no maintainer reply and no linked spec PR. The Streamable HTTP file on main last changed in 4d260f4 (2026-08-21), and the Security section reads as quoted above.

The expected status (403) and the two miss severities are three constants in one commented block in src/scenarios/server/dns-rebinding.ts. If #3370 lands as proposed, the change is: Host miss WARNING to FAILURE, Origin miss FAILURE to WARNING, 403 unchanged.

Pass and fail examples

Results at 2025-11-25:

Server combined Host-only Origin-only valid accepted
everything-server with an added Origin check SUCCESS SUCCESS SUCCESS SUCCESS
everything-server as on main (Host only) SUCCESS SUCCESS FAILURE (200) SUCCESS
new dns-rebinding-host-only.ts SUCCESS SUCCESS FAILURE (200) SUCCESS
new dns-rebinding-origin-only.ts SUCCESS WARNING (200) SUCCESS SUCCESS
no-dns-rebinding-protection.ts FAILURE WARNING FAILURE SUCCESS

The branch adds the Origin check to the everything-server so it stays green, adds the two fixtures, and asserts each row in negative.test.ts.

Against real SDK conformance servers (conformance sdk ... --mode server --scenario dns-rebinding-protection):

  • python-sdk main (f1b6589): 4/4 pass. Its localhost default validates both headers and returns 421 for Host, 403 for Origin.
  • typescript-sdk v1.x (289ac2c, 1.30.1): 3/4. The Origin-only check fails with 200; its conformance server uses localhostHostValidation() only. It would need a fix or a baseline entry. The v2 conformance server on main uses the same middleware; I have not run it.

Related fixture bug

no-dns-rebinding-protection.ts declares inputSchema: { message: { type: 'string' } }, which SDK 1.29 rejects, so the fixture returns 500 for every request. The existing negative test passes on that 500, not on the missing protection. The branch switches it to z.string(); after that it returns 200 to the forged request and the check fails for the right reason.

Branch: https://github.com/modelcontextprotocol/conformance/compare/main...ninadphalak:conformance:server-dns-rebinding-split-checks

Ngôn ngữ chính
TypeScript
Star
127
Fork
107
Merge trung bình
2 ngày 22 giờ
Pull request đã merge (30 ngày)
5

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của modelcontextprotocol/conformance

Tất cả issue của modelcontextprotocol/conformance

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.