fix(security): warn on empty allowed_hosts and improve 421/403 response bodies#2694
Open
BSmick6 wants to merge 1 commit into
Open
Conversation
…se bodies When TransportSecuritySettings is constructed with DNS rebinding protection enabled but allowed_hosts=[], every request is silently rejected with a bare HTTP 421 — hard to diagnose without reading the SDK source. Add a model_validator that emits a logger.warning at construction time pointing users at allowed_hosts configuration. Also include the received header value and a configuration hint in the 421/403 response bodies. Removes all pragma: no cover markers from transport_security.py by adding a direct unit test file (test_transport_security.py) that exercises all branches without subprocesses. Updates the existing integration tests to use substring matching now that the response bodies carry extra context. Closes modelcontextprotocol#2688 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #2688.
When
TransportSecuritySettingsis constructed withenable_dns_rebinding_protection=True(the default) butallowed_hosts=[](also the default), every incoming request is silently rejected with a bareHTTP 421 Misdirected Request. The cause is invisible without reading the SDK source.Changes:
model_validatortoTransportSecuritySettingsthat emits alogger.warningat construction time when protection is enabled butallowed_hostsis empty, pointing the user at the configuration neededTransportSecuritySettings(allowed_hosts=[...])hint in the421and403response bodies so users can self-diagnose from the response alone# pragma: no covermarkers fromtransport_security.pyby addingtests/server/test_transport_security.py— 21 direct unit tests covering all branches without subprocessestest_sse_security.py,test_streamable_http_security.py) to substring matches to accommodate the richer response bodiesNote: this PR overlaps in file scope with #2498 (subdomain wildcard support). There will be conflicts due to both producing tests for
transport_security.pyTest plan
uv run --frozen pytest tests/server/test_transport_security.py— 21 new unit tests, all passuv run --frozen pytest tests/server/test_sse_security.py tests/server/test_streamable_http_security.py— existing integration tests still passuv run --frozen pytest— 1193 passed, 98 skipped, 1 xfaileduv run --frozen coverage report --include='src/mcp/server/transport_security.py'— 100% branch coverage, no pragmas remaining🤖 Generated (partially) with Claude Code