security: enforce MCP Origin allowlist to prevent DNS-rebinding attacks by prakhar-singh1928 · Pull Request #75 · contextforge-org/contextforge-data-plane

security: enforce MCP Origin allowlist to prevent DNS-rebinding attacks

prakhar-singh1928

committed

c7fd75f

fix CI

prakhar-singh1928

committed

0b11c75

fix(security): strict Origin syntax, startup validation error, request-flow docs

prakhar-singh1928

committed

ce0fbfb

fix(security): use ? operator in parse_origin, fix security-model wording

prakhar-singh1928

committed

07130d3

reduced comments

prakhar-singh1928

committed

72665d7

fix fmt-all

prakhar-singh1928

committed

ed2a62a

fix(security): mcp_allowed_hosts as Option to make disabled state explicit

prakhar-singh1928

committed

64259cd

fix(security): simplify origin/host config to Option<Vec<String>>, drop value_parser

prakhar-singh1928

committed

2104475

fix(security): simplify parse_origin, remove redundant pre-parse guards

prakhar-singh1928

committed

52cd7a5

remove redundant url.host()

prakhar-singh1928

committed

1b37b89

use Authority type for mcp_allowed_hosts, drop manual string splitting

prakhar-singh1928

committed

98c9279

drop to_ascii_lowercase

prakhar-singh1928

committed

b4b9b63

use url::Url for mcp_allowed_origins, drop string parsing at request time

prakhar-singh1928

committed

d39455b

Navigation Menu

Uh oh!

security: enforce MCP Origin allowlist to prevent DNS-rebinding attacks - #75

security: enforce MCP Origin allowlist to prevent DNS-rebinding attacks#75
dawid-nowak merged 13 commits into
mainfrom
fix/issue-421

Commits on Aug 10, 2026

security: enforce MCP Origin allowlist to prevent DNS-rebinding attacks

fix CI

fix(security): strict Origin syntax, startup validation error, request-flow docs

fix(security): use ? operator in parse_origin, fix security-model wording

reduced comments

fix fmt-all

fix(security): mcp_allowed_hosts as Option to make disabled state explicit

fix(security): simplify origin/host config to Option<Vec<String>>, drop value_parser

fix(security): simplify parse_origin, remove redundant pre-parse guards

remove redundant url.host()

use Authority type for mcp_allowed_hosts, drop manual string splitting

drop to_ascii_lowercase

use url::Url for mcp_allowed_origins, drop string parsing at request time