8fa2ff4423
The go-sdk Streamable HTTP handler enables DNS-rebinding protection that rejects any request whose Host header is non-loopback while the server is bound to a loopback address. memos is commonly run bound to loopback behind a reverse proxy (e.g. the public demo), so every /mcp request was rejected with "403 Forbidden: invalid Host header" before authentication ran. Disable the SDK's localhost protection and rely on memos' own Origin/Host allowlist (isAllowedMCPOrigin) for CSRF / DNS-rebinding protection. Add a regression test covering the proxied shape and confirming disallowed origins are still rejected. |
||
|---|---|---|
| .. | ||
| auth | ||
| notification | ||
| router | ||
| runner | ||
| cors.go | ||
| cors_test.go | ||
| server.go | ||