fix: harden MCP server auth, CORS, and request size limits - #607
Conversation
- Log warning when MCP server has no auth configured - Reject all requests when bearer auth lacks a validate function - Match CORS Origin against full origins array instead of only first entry - Require explicit origins (no "*" default) when CORS enabled - Add 1MB request body size limit before JSON parsing
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 01cac11faf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ariskemper
changed the title
- Replace parseInt with Number() for cleaner NaN handling - Add bearer auth tests: missing validate, missing header, valid/invalid token - Add body size limit tests: Content-Length fast path, body fallback, within limit - Add CORS tests: matching origin, non-matching origin, no origins, disabled, POST response
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6a8e7b2d0a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Without Vary: Origin, shared caches/CDNs can serve a response cached for one origin to requests from a different origin, causing CORS failures.
1 participant
Summary
originsarray instead of onlyorigins[0]; require explicit origins when CORS enabled (no"*"default)Test plan