Jakob Wennberg
03a2130919
Closes the two code-side gaps found while auditing the Claude Connectors Directory submission checklist after #682/#683: 1. Origin-header validation on the /mcp endpoint (POST/GET/DELETE) — an explicit directory submission requirement and an MCP spec MUST for the Streamable HTTP transport (DNS-rebinding defense). Requests without an Origin header (claude.ai backend, Claude Desktop, npx gnubok-mcp, Claude Code, MCP Inspector's proxy — every known client) pass through unchanged. A present Origin is allowed only when its host matches the request Host (covers Vercel previews + self-hosted without hardcoding) or NEXT_PUBLIC_APP_URL (proxy-rewritten Host); anything else is 403 with a JSON-RPC error envelope. The endpoint sets no CORS headers, so no currently-working browser flow is affected. 2. serverInfo.title: 'Accounted' (MCP 2025-06-18 display name). name stays 'gnubok' — stable identifier clients may key state on. 3. export-docs-to-website.mts now also exports CONNECT_CLAUDE_MD to the gnubok-website repo, so docs.gnubok.se/connect-claude (the target of the canonical /docs/api redirect) stays in sync. Companion website PR: jakobwennberg/gnubok-website#1. Tests: new origin-guard.test.ts (10 tests — no-Origin pass-through, same-origin, preview host, proxy host via env, foreign/port-mismatch/ null/malformed rejection, 403 envelope, and per-method enforcement on the registered apiRoutes). Full MCP suite 295/295 green. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
60 lines
2.0 KiB
TypeScript
60 lines
2.0 KiB
TypeScript
/**
|
|
* Origin-header validation for the MCP Streamable HTTP endpoint.
|
|
*
|
|
* MCP spec (2025-06-18, Streamable HTTP transport): "Servers MUST validate
|
|
* the Origin header on all incoming connections to prevent DNS rebinding
|
|
* attacks." Also an explicit Claude Connectors Directory submission
|
|
* requirement.
|
|
*
|
|
* Non-browser clients send no Origin header and are allowed: claude.ai's
|
|
* backend connector, Claude Desktop, the npx gnubok-mcp bridge, Claude Code,
|
|
* and MCP Inspector (whose Node proxy makes the actual call). A browser page
|
|
* sends its own origin: allowed only when it matches the deployment's own
|
|
* host — compared against the request Host (covers Vercel previews and
|
|
* self-hosted domains without hardcoding) and NEXT_PUBLIC_APP_URL (covers
|
|
* proxies that rewrite Host). Anything else is a cross-site browser request
|
|
* the endpoint never serves (it sets no CORS headers), so reject explicitly.
|
|
*/
|
|
export function isForbiddenOrigin(request: Request): boolean {
|
|
const origin = request.headers.get('origin')
|
|
if (!origin) return false
|
|
|
|
let originHost: string
|
|
try {
|
|
originHost = new URL(origin).host
|
|
} catch {
|
|
// Malformed Origin (including the literal "null" some browsers send for
|
|
// sandboxed/opaque contexts) — treat as foreign.
|
|
return true
|
|
}
|
|
|
|
const allowedHosts = new Set<string>()
|
|
const hostHeader = request.headers.get('host')
|
|
if (hostHeader) allowedHosts.add(hostHeader)
|
|
try {
|
|
allowedHosts.add(new URL(request.url).host)
|
|
} catch {
|
|
// request.url should always parse; ignore if not.
|
|
}
|
|
if (process.env.NEXT_PUBLIC_APP_URL) {
|
|
try {
|
|
allowedHosts.add(new URL(process.env.NEXT_PUBLIC_APP_URL).host)
|
|
} catch {
|
|
// Misconfigured env var — fall through to the request-derived hosts.
|
|
}
|
|
}
|
|
|
|
return !allowedHosts.has(originHost)
|
|
}
|
|
|
|
export function forbiddenOriginResponse(): Response {
|
|
return Response.json(
|
|
{
|
|
jsonrpc: '2.0',
|
|
id: null,
|
|
error: { code: -32600, message: 'Origin not allowed' },
|
|
},
|
|
{ status: 403 },
|
|
)
|
|
}
|