stacklok / toolhive / 28402376273

68%

Build Type

push

github

Committed by web-flow

Commit Message

Add Origin header validation for DNS-rebind protection (#4908)

Add Origin header validation middleware

ToolHive's proxy layer had no Origin-header validation, and the legacy
HTTP+SSE transport sent `Access-Control-Allow-Origin: *`, leaving both
modes open to DNS-rebinding attacks from browser clients. MCP 2025-11-25
§"Security Warning" requires servers to validate Origin on all
connections and respond 403 when the value is invalid.

This change introduces a dedicated middleware at
pkg/transport/middleware/origin/ that rejects requests whose Origin
header is present and not in an operator-configured allowlist. It is
wired centrally in runner.Run for both the factory-based chain
(thv run / thv-proxyrunner) and inline in the `thv proxy` chain.

Wiring is done in runner.Run rather than in the builder because that is
the only point where the effective Host/Port/AllowedOrigins are fully
resolved: the CLI builder (WithMiddlewareFromFlags) defers port
resolution to validateConfig, so an earlier hook would see port 0 and
silently disable loopback-default protection for `thv run`. The
middleware is prepended so Origin validation runs first in the chain.

Behavior:
- New --allowed-origins flag on `thv run` and `thv proxy` accepts a
  repeatable exact-match list. When empty and the bind host is
  loopback, a default loopback-only allowlist is derived automatically
  (http://localhost:PORT + 127.0.0.1 + [::1]). When empty and the
  bind is non-loopback, the middleware is skipped and a warning is
  logged — the bind-opt-in hardening lands in a follow-up.
- Matching parses each value with net/url and compares scheme://host
  [:port] with scheme and host lowercased per RFC 6454 §4. Values
  carrying userinfo (RFC 6454 §6) or that fail to parse never match,
  closing an Origin-smuggling vector. Requests with multiple Origin
  headers are rejected outright.
- 403 responses carry a JSON-RPC error body (id: null, code -32600,
  message "Origin not allowed").
- `Access-... (continued)

Coverage Stats

161 of 192 new or added lines in 7 files covered. (83.85%)

3 existing lines in 2 files now uncovered.

70752 of 104823 relevant lines covered (67.5%)

64.36 hits per line