Skip to content

server: restrict default CORS to allowed origins #1074

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TheodorNEngoy wants to merge 1 commit into
base: main
Choose a base branch
from
Open

server: restrict default CORS to allowed origins #1074

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 31 additions & 12 deletions server/src/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,12 +172,38 @@ const updateHeadersInPlace = (
}
};

const getAllowedOrigins = (): string[] => {
const clientPort = process.env.CLIENT_PORT || "6274";
const defaultOrigins = [
`http://localhost:${clientPort}`,
`http://127.0.0.1:${clientPort}`,
`http://[::1]:${clientPort}`,
];

const raw = process.env.ALLOWED_ORIGINS;
if (!raw) return defaultOrigins;

const fromEnv = raw
.split(",")
.map((s) => s.trim())
.filter(Boolean);

return fromEnv.length ? fromEnv : defaultOrigins;
};

const allowedOrigins = getAllowedOrigins();

const app = express();
app.use(cors());
app.use((req, res, next) => {
res.header("Access-Control-Expose-Headers", "mcp-session-id");
next();
});
app.use(
cors({
origin: (origin, cb) => {
// Allow non-browser clients (no Origin header).
if (!origin) return cb(null, true);
return cb(null, allowedOrigins.includes(origin));
},
exposedHeaders: ["mcp-session-id"],
}),
);

const webAppTransports: Map<string, Transport> = new Map<string, Transport>(); // Web app transports by web app sessionId
const serverTransports: Map<string, Transport> = new Map<string, Transport>(); // Server Transports by web app sessionId
Expand All @@ -196,13 +222,6 @@ const originValidationMiddleware = (
) => {
const origin = req.headers.origin;

// Default origins based on CLIENT_PORT or use environment variable
const clientPort = process.env.CLIENT_PORT || "6274";
const defaultOrigin = `http://localhost:${clientPort}`;
const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || [
defaultOrigin,
];

if (origin && !allowedOrigins.includes(origin)) {
console.error(`Invalid origin: ${origin}`);
res.status(403).json({
Expand Down