Return HTTP 403 when Origin header is invalid #695

Activity

1. Kehrlann

   added this to 2025-11-25 Implementationon Nov 26, 2025
2. Kehrlann

   added the

   Enhancement

   issue type on Nov 26, 2025
3. Kehrlann

   moved this to Backlog in 2025-11-25 Implementationon Nov 26, 2025
4. Kehrlann

   self-assigned this

   on Jan 28, 2026
5. Kehrlann commented on Jan 29, 2026

   

   Kehrlann

   on Jan 29, 2026

   ContributorAuthor

   More actions

   Python implementation: modelcontextprotocol/python-sdk#861
   Typescript implementation: https://github.com/modelcontextprotocol/typescript-sdk/pull/565/changes

   Note: they also validate the host, not only the origin.
6. Kehrlann

   added 2 commits that reference this issue on Feb 4, 2026

   Add Origin header validation

   ...

   This issue will close once commit a18f327 is merged into the 'main' branch.

   a18f327

   Add Origin header validation

   ...

   This issue will close once commit 9903b56 is merged into the 'main' branch.

   9903b56
7. Kehrlann

   closed this as completedin #771on Feb 5, 2026
8. github-project-automation

   moved this from Backlog to Done in 2025-11-25 Implementationon Feb 5, 2026
9. pull

   added a commit that references this issue on Feb 5, 2026

   Add Origin header validation

   ...

   This issue will close once commit 96c9bbe is merged into the 'main' branch.

   96c9bbe