Skip to content

Add configurable Host/Origin allowlist for the MCP endpoint#3736

Open
souvikghosh04 wants to merge 8 commits into
mainfrom
mcp-allowed-hosts-validation
Open

Add configurable Host/Origin allowlist for the MCP endpoint#3736
souvikghosh04 wants to merge 8 commits into
mainfrom
mcp-allowed-hosts-validation

Conversation

@souvikghosh04

Copy link
Copy Markdown
Contributor

Why

The MCP Streamable HTTP endpoint is reachable from browsers. Today it accepts requests regardless of the incoming Host/Origin header, which is broader than necessary for a locally- or internally-hosted endpoint. This change adds defense-in-depth by letting operators constrain which hosts and origins may reach the MCP endpoint, with a safe default.

What

  • New optional config runtime.mcp.allowed-hosts (array of host names).
  • New middleware that validates the Host header — and the Origin header when present — for requests targeting the configured MCP path.
  • Loopback hosts (localhost, 127.0.0.1, ::1) are always trusted so local MCP clients keep working with no additional configuration.
  • A single "*" entry opts out of validation, preserving prior behavior for deployments that terminate host validation upstream.
  • Requests from untrusted hosts/origins receive 403 Forbidden before reaching the MCP transport.
  • JSON schema and config serialization updated to support the new property.

Behavior change

Deployments that expose the MCP endpoint on a non-loopback host name must add that host name to runtime.mcp.allowed-hosts (or set "*" to keep the previous behavior).

Testing

  • Added unit tests covering the host/origin validation logic and the middleware pipeline behavior (pass-through, disabled, and rejection paths).
  • Added serialization round-trip tests for the new allowed-hosts property.
  • dotnet format --verify-no-changes is clean on the changed files.

Introduces runtime.mcp.allowed-hosts so operators can restrict which Host and Origin header values are accepted by the MCP Streamable HTTP endpoint. Loopback hosts are always trusted; a single '*' entry preserves prior behavior. Adds validation middleware, config plumbing, schema, and unit tests.
@souvikghosh04 souvikghosh04 self-assigned this Jul 23, 2026
@souvikghosh04 souvikghosh04 moved this from Todo to In Progress in Data API builder Jul 23, 2026
@souvikghosh04 souvikghosh04 added this to the July 2026 milestone Jul 23, 2026
The new UserProvidedAllowedHosts helper flag is not serialized to the config file, mirroring UserProvidedPath. Ignore it in the Cli.Tests and Service.Tests Verify module initializers so snapshot tests remain stable.
@souvikghosh04
souvikghosh04 marked this pull request as ready for review July 24, 2026 12:01
Copilot AI review requested due to automatic review settings July 24, 2026 12:01

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a defense-in-depth DNS rebinding mitigation for the browser-reachable MCP Streamable HTTP endpoint by introducing a configurable Host/Origin allowlist in runtime config, plus schema and test coverage.

Changes:

  • Introduces runtime.mcp.allowed-hosts and serializes it only when explicitly user-provided.
  • Adds McpDnsRebindingProtectionMiddleware and wires it into the Service middleware pipeline for requests targeting the MCP path.
  • Updates JSON schema and adds unit/serialization tests for the new behavior and config round-tripping.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
src/Service/Startup.cs Inserts the MCP DNS rebinding protection middleware into the request pipeline.
src/Azure.DataApiBuilder.Mcp/Core/McpDnsRebindingProtectionMiddleware.cs Implements Host/Origin validation (loopback trusted, "*" opt-out) for MCP path requests.
src/Config/ObjectModel/McpRuntimeOptions.cs Adds AllowedHosts and a UserProvidedAllowedHosts flag for controlled serialization.
src/Config/Converters/McpRuntimeOptionsConverterFactory.cs Deserializes/serializes allowed-hosts gated by the user-provided flag.
src/Service.Tests/Mcp/McpDnsRebindingProtectionMiddlewareTests.cs Adds unit tests for trust decisions and middleware pipeline behavior.
src/Service.Tests/Configuration/McpRuntimeOptionsSerializationTests.cs Adds serialization/deserialization coverage for allowed-hosts.
src/Service.Tests/ModuleInitializer.cs Updates snapshot settings to ignore the new non-serialized flag.
src/Cli.Tests/ModuleInitializer.cs Updates snapshot settings to ignore the new non-serialized flag.
schemas/dab.draft.schema.json Adds schema support and documentation for runtime.mcp.allowed-hosts.

Comment thread src/Config/Converters/McpRuntimeOptionsConverterFactory.cs Outdated
Comment thread src/Service.Tests/Configuration/McpRuntimeOptionsSerializationTests.cs Outdated
Comment thread src/Service.Tests/Configuration/McpRuntimeOptionsSerializationTests.cs Outdated
souvikghosh04 and others added 3 commits July 24, 2026 17:39
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…re/data-api-builder into mcp-allowed-hosts-validation

# Conflicts:
#	src/Config/Converters/McpRuntimeOptionsConverterFactory.cs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Review In Progress

Development

Successfully merging this pull request may close these issues.

4 participants