PRODUCTION SCENARIO
A developer runs a local MCP server over Streamable HTTP on port 8080 for a desktop client. To avoid connection issues the server binds to 0.0.0.0 and accepts any Origin header.
Which control stops a rebound request from being served?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Validating the Origin header on every incoming connection
Origin validation is the control the transport names for DNS rebinding: the attacker's page carries its own origin, so checking it and returning 403 is what rejects the request. The spec asks for the localhost bind and for authentication too, but neither helps here, because rebinding works precisely by making the victim's own browser resolve an attacker domain to 127.0.0.1 and send a same-machine request that may carry the user's credentials. And the 2026-07-28 revision removed protocol-level sessions, so there is no Mcp-Session-Id to check.