8fa2ff4423
The go-sdk Streamable HTTP handler enables DNS-rebinding protection that rejects any request whose Host header is non-loopback while the server is bound to a loopback address. memos is commonly run bound to loopback behind a reverse proxy (e.g. the public demo), so every /mcp request was rejected with "403 Forbidden: invalid Host header" before authentication ran. Disable the SDK's localhost protection and rely on memos' own Origin/Host allowlist (isAllowedMCPOrigin) for CSRF / DNS-rebinding protection. Add a regression test covering the proxied shape and confirming disallowed origins are still rejected. |
||
|---|---|---|
| .. | ||
| api/v1 | ||
| fileserver | ||
| frontend | ||
| mcp | ||
| rss | ||