Follow redirects only within the MCP endpoint's origin - #3397

Merged

maxisbey merged 7 commits into

mainfrom

same-origin-redirects

Sep 4, 2026

Commits on Aug 26, 2026

Follow redirects only within the MCP endpoint's origin
maxisbey
committed
8080719
Only follow method-preserving redirects; resolve unfollowed ones on every path
maxisbey
committed
4a4b8fb

Commits on Sep 4, 2026

Apply the redirect rule to OAuth's own requests; clearer message for an https-to-http redirect
maxisbey
committed
22d3735
Merge remote-tracking branch 'origin/main' into same-origin-redirects
maxisbey
committed
2983290
Name redirect locations without query or userinfo everywhere; refuse-message covers any http downgrade
maxisbey
committed
1051429
docs: give redirect handling its own short section; add the proxy-headers note to Deploy
maxisbey
committed
9dc7b84
docs: say which same-origin redirects are followed (307/308) in the Redirects section and recap
maxisbey
committed
f98f5f3