PRODUCTION SCENARIO
A developer runs a local MCP server over Streamable HTTP on port 8080 for a desktop client. To avoid connection issues, the server binds to 0.0.0.0 and accepts any Origin header.
What must the server do to prevent DNS rebinding attacks?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Validate the Origin header on every connection, bind to localhost, and authenticate
The Streamable HTTP transport requires servers to validate the Origin header on every incoming connection to stop DNS rebinding, to bind only to localhost when running locally, and to authenticate connections. Session headers, TLS, and subnet firewalls do not help, because the rebound request arrives from the user's own browser.