stacklok / toolhive / 24251612365

66%

Build Type

push

github

Committed by web-flow

Commit Message

Follow HTTP redirects in transparent proxy (#4454)

* Follow HTTP redirects in transparent proxy

MCP clients expect JSON-RPC responses and cannot handle
HTTP redirects. When a remote server returns a 3xx redirect,
the proxy now follows it transparently instead of passing
the redirect response to the client.

Fixes #4453

Signed-off-by: Greg Katz <gkatz@indeed.com>

* Block cross-host redirects to prevent SSRF

A malicious MCP server could redirect the proxy to internal
cluster services (Kubernetes API, cloud IMDS). Restrict
redirect following to same-host only and return the 3xx
response as-is for cross-host redirects.

Signed-off-by: Greg Katz <gkatz@indeed.com>

* Suppress goconst for https scheme literal

Signed-off-by: Greg Katz <gkatz@indeed.com>

---------

Signed-off-by: Greg Katz <gkatz@indeed.com>

Coverage Stats

53 of 58 new or added lines in 1 file covered. (91.38%)

24 existing lines in 5 files now uncovered.

56217 of 85965 relevant lines covered (65.4%)

63.1 hits per line