Skip to content

Validate origin header - #771

Merged
Kehrlann merged 2 commits into
mainfrom
dgarnier/validate-origin-header
Feb 5, 2026
Merged

Validate origin header#771
Kehrlann merged 2 commits into
mainfrom
dgarnier/validate-origin-header

Conversation

@Kehrlann

@KehrlannKehrlann commented Feb 4, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Fixes#695 . Updates conformance tests.

Contents

Add Origin header validation for HTTP-based MCP server transports so servers can restrict which origins can connect (e.g. browser or cross-origin clients).

Introduces new ServerTransportSecurityValidator interface, to validate transport-level security. Default behavior stays permissive: transports use ServerTransportSecurityValidator.NOOP unless a validator is set via the builder.

The provided implementation is DefaultServerTransportSecurityValidator and only validates the Origin header, for now.

New APIs: example usage

HttpServletStreamableServerTransportProvider.builder()
// ...
.securityValidator(
DefaultServerTransportSecurityValidator.builder()
.allowedOrigin("http://localhost:*")
.build())
// ...

Points of interest

Integration tests use the new JUnit 6 @ParameterizedClass API, which is another way of implementation "abstract base classes" for tests.

@Kehrlann
Add Origin header validation
9903b56
- Fixes#695
- Does not implement Host header validation yet
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
@Kehrlann
Kehrlann requested review from chemicL and tzolov and removed request for chemicLFebruary 4, 2026 20:19
@Kehrlann
Update conformance tests with DNS rebinding protection
68ed795
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
@Kehrlann
Kehrlannforce-pushed the dgarnier/validate-origin-header branch from e5624d4 to 68ed795CompareFebruary 4, 2026 20:20
@Kehrlann
Kehrlann requested a review from chemicLFebruary 4, 2026 20:23
@Kehrlann
Kehrlann marked this pull request as ready for review February 4, 2026 20:23
tzolov
tzolov approved these changes Feb 5, 2026
View reviewed changes

@tzolovtzolov left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Great work @Kehrlann !

Comment thread...a/io/modelcontextprotocol/server/transport/DefaultServerTransportSecurityValidatorTests.java

@Test
void differentSchemeWithWildcard() {
var headers = originHeader("https://localhost:3000");

@tzolovtzolovFeb 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't the port be 8080 to ensure that it fails because of the schema?

@KehrlannKehrlannFeb 5, 2026

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's using the the wildcard validator, so the port does not matter:

privatefinalDefaultServerTransportSecurityValidatorwildcardValidator =
DefaultServerTransportSecurityValidator
.builder()
.allowedOrigin("http://localhost:*")
.build();

@Kehrlann
Kehrlann merged commit 5ed6063 into mainFeb 5, 2026
6 checks passed
@Kehrlann
Kehrlann deleted the dgarnier/validate-origin-header branch February 5, 2026 09:20
chemicL
chemicL reviewed Feb 10, 2026
View reviewed changes

@chemicLchemicL left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @Kehrlann for taking care of this! I added a few comments post merge. Perhaps eliminating the duplicated code can be addressed as a follow-up. Great job overall!

Comment thread...n/java/io/modelcontextprotocol/server/transport/DefaultServerTransportSecurityValidator.java
Comment thread...n/java/io/modelcontextprotocol/server/transport/DefaultServerTransportSecurityValidator.java
Comment thread...ain/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java
Comment thread.../main/java/io/modelcontextprotocol/server/transport/HttpServletStatelessServerTransport.java
Comment on lines +138 to +145
try {
Map<String, List<String>> headers = extractHeaders(request);
this.securityValidator.validateHeaders(headers);
}
catch (ServerTransportSecurityException e) {
response.sendError(e.getStatusCode(), e.getMessage());
return;
}

@chemicLchemicLFeb 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This code is duplicated across three implementations, perhaps we can have a centralized static utility for it?

Comment thread.../main/java/io/modelcontextprotocol/server/transport/HttpServletStatelessServerTransport.java
Comment thread...a/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java
Comment thread...a/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java
Comment thread...a/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java
Comment thread...t/java/io/modelcontextprotocol/server/transport/ServerTransportSecurityIntegrationTests.java
Comment thread...rc/main/java/io/modelcontextprotocol/server/transport/WebFluxSseServerTransportProvider.java
Kehrlann added a commit that referenced this pull request Feb 12, 2026
@Kehrlann
Polishgh-771
9ae9736
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
Kehrlann added a commit that referenced this pull request Feb 12, 2026
@Kehrlann
Polishgh-771
b57b126
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
@KehrlannKehrlann mentioned this pull request Feb 16, 2026
Closed
9 tasks
@KehrlannKehrlann mentioned this pull request Mar 16, 2026
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chemicLchemicLchemicL left review comments
@tzolovtzolovtzolov approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Return HTTP 403 when Origin header is invalid

3 participants

@Kehrlann@tzolov@chemicL