MCP-SEC-001

Invalid Origin header returns HTTP 403

“Servers MUST validate the Origin header on all incoming connections to prevent DNS rebinding attacks. If the Origin header is present and invalid, servers MUST respond with HTTP 403 Forbidden.” — spec anchor

How to fix this

Validate the `Origin` header on every incoming request and answer an invalid one with HTTP 403. This is the DNS-rebinding defence — without it a page in a victim's browser can reach a server bound to localhost.

Example: failing and passing

A request carrying a foreign Origin is processed normally, which leaves the server open to DNS rebinding.

Violates MCP-SEC-001 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Origin: https://attacker.example
Content-Type: application/json
Mcp-Method: tools/list
...

HTTP/1.1 200 OK
Content-Type: application/json
...

The server checks Origin, does not recognise it, and responds 403 Forbidden.

Complies with MCP-SEC-001 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Origin: https://attacker.example
Content-Type: application/json
Mcp-Method: tools/list
...

HTTP/1.1 403 Forbidden

How the validator checks this

Probe P7.1, against a streamable-http server on the modern protocol. What it reports:

pass: An invalid Origin was rejected with 403
warn: Request with a foreign Origin returned HTTP … rather than 403 — rejected, but not in the way the spec names
fail: Accepted a request with an unrecognised Origin. Servers MUST validate Origin to prevent DNS rebinding, and reject an invalid one with 403.

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Check your own server against MCP-SEC-001

Probe P7.1 checks MCP-SEC-001 in a request of its own, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.