allowedOrigins property
Allowed Origin header values for DNS-rebinding protection
(MCP 2025-11-25 requires HTTP 403 Forbidden for invalid Origin
headers on the Streamable HTTP transport).
A request carrying an Origin that is not in this list is rejected with
403 Forbidden before dispatch. Requests without an Origin header are
not affected — they did not come from a browser, so they cannot be a
rebinding attempt.
When null (default) the allow-list is the local machine
(localhost / 127.0.0.1 / [::1], any scheme or port). Name the
origins that must reach this server to widen it, or set
allowAnyOrigin to turn the check off.
Implementation
final List<String>? allowedOrigins;