Modify Origin header validation in validateRequestHeaders (streamableHttp.ts and sse.ts) to allow requests without an Origin, as they are not relevant to server DNS rebinding protection.

[jacopoc]

Motivation and Context

In the context of DNS rebinding protection, the condition to validate the Origin header has been modified in validateRequestHeaders (in both streamableHttp.ts and sse.ts) in order to prevent the rejection of requests that do not include an Origin header, such as those not originating from browsers, since they are not related to DNS rebinding attacks against the server.

Moreover, before this change, the Origin validation condition in validateRequestHeaders, i.e.

if (!originHeader || !this._allowedOrigins.includes(originHeader)) {
    return `Invalid Origin header: ${originHeader}`;
}

was not compliant with the latest version (2025-11-25) of the MCP specification (Transports - 2.0.1 Security Warning) that states:

If the Origin header is present and invalid, servers MUST respond with HTTP 403 Forbidden.

Instead, the updated Origin validation condition

if (originHeader && !this._allowedOrigins.includes(originHeader)) {
    return `Invalid Origin header: ${originHeader}`;
}

closely implements the specification.

How Has This Been Tested?

Along with the modified condition, this pull request introduces two new tests to verify the acceptance of requests without an Origin header when DNS Rebinding protection is enabled.

Breaking Changes

No breaking changes have been introduced.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/sdk@1205

commit: 2b77c85