Add configurable Host/Origin allowlist for the MCP endpoint by souvikghosh04 · Pull Request #3736 · Azure/data-api-builder

souvikghosh04 · 2026-07-23T12:56:37Z

Why

The MCP Streamable HTTP endpoint is reachable from browsers. Today it accepts requests regardless of the incoming Host/Origin header, which is broader than necessary for a locally- or internally-hosted endpoint. This change adds defense-in-depth by letting operators constrain which hosts and origins may reach the MCP endpoint, with a safe default.

What

New optional config runtime.mcp.allowed-hosts (array of host names).
New middleware that validates the Host header — and the Origin header when present — for requests targeting the configured MCP path.
Loopback hosts (localhost, 127.0.0.1, ::1) are always trusted so local MCP clients keep working with no additional configuration.
A single "*" entry opts out of validation, preserving prior behavior for deployments that terminate host validation upstream.
Requests from untrusted hosts/origins receive 403 Forbidden before reaching the MCP transport.
JSON schema and config serialization updated to support the new property.

Behavior change

Deployments that expose the MCP endpoint on a non-loopback host name must add that host name to runtime.mcp.allowed-hosts (or set "*" to keep the previous behavior).

Testing

Added unit tests covering the host/origin validation logic and the middleware pipeline behavior (pass-through, disabled, and rejection paths).
Added serialization round-trip tests for the new allowed-hosts property.
dotnet format --verify-no-changes is clean on the changed files.

Introduces runtime.mcp.allowed-hosts so operators can restrict which Host and Origin header values are accepted by the MCP Streamable HTTP endpoint. Loopback hosts are always trusted; a single '*' entry preserves prior behavior. Adds validation middleware, config plumbing, schema, and unit tests.

The new UserProvidedAllowedHosts helper flag is not serialized to the config file, mirroring UserProvidedPath. Ignore it in the Cli.Tests and Service.Tests Verify module initializers so snapshot tests remain stable.

Copilot

Pull request overview

Adds a defense-in-depth DNS rebinding mitigation for the browser-reachable MCP Streamable HTTP endpoint by introducing a configurable Host/Origin allowlist in runtime config, plus schema and test coverage.

Changes:

Introduces runtime.mcp.allowed-hosts and serializes it only when explicitly user-provided.
Adds McpDnsRebindingProtectionMiddleware and wires it into the Service middleware pipeline for requests targeting the MCP path.
Updates JSON schema and adds unit/serialization tests for the new behavior and config round-tripping.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/Service/Startup.cs	Inserts the MCP DNS rebinding protection middleware into the request pipeline.
src/Azure.DataApiBuilder.Mcp/Core/McpDnsRebindingProtectionMiddleware.cs	Implements Host/Origin validation (loopback trusted, `"*"` opt-out) for MCP path requests.
src/Config/ObjectModel/McpRuntimeOptions.cs	Adds `AllowedHosts` and a `UserProvidedAllowedHosts` flag for controlled serialization.
src/Config/Converters/McpRuntimeOptionsConverterFactory.cs	Deserializes/serializes `allowed-hosts` gated by the user-provided flag.
src/Service.Tests/Mcp/McpDnsRebindingProtectionMiddlewareTests.cs	Adds unit tests for trust decisions and middleware pipeline behavior.
src/Service.Tests/Configuration/McpRuntimeOptionsSerializationTests.cs	Adds serialization/deserialization coverage for `allowed-hosts`.
src/Service.Tests/ModuleInitializer.cs	Updates snapshot settings to ignore the new non-serialized flag.
src/Cli.Tests/ModuleInitializer.cs	Updates snapshot settings to ignore the new non-serialized flag.
schemas/dab.draft.schema.json	Adds schema support and documentation for `runtime.mcp.allowed-hosts`.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…re/data-api-builder into mcp-allowed-hosts-validation # Conflicts: # src/Config/Converters/McpRuntimeOptionsConverterFactory.cs

RubenCerna2079

Change logic that checks allowed Hosts using Contains function in order to ensure that it doesn't approve incomplete Hosts accidentally.

RubenCerna2079 · 2026-07-29T18:53:36Z

              "type": "string",
              "description": "Description of the MCP server, exposed as the 'instructions' field in the MCP initialize response to provide behavioral context to MCP clients and agents."
            },
+            "allowed-hosts": {


This appears to be a new feature to fix the issue. So I think that should be added to the PR description.

RubenCerna2079 · 2026-07-29T18:54:48Z

            },
+            "allowed-hosts": {
+              "type": "array",
+              "description": "Host names that are trusted to reach the browser-reachable MCP endpoint. Protects the MCP Streamable HTTP transport against DNS rebinding attacks by validating the incoming Host and Origin headers. Loopback hosts (localhost, 127.0.0.1, ::1) are always trusted. A single entry of '*' disables Host/Origin validation and is not recommended.",


I don't see anywhere where this new property can be added or edited through the CLI. Will that be added in a different PR?

RubenCerna2079 · 2026-07-29T20:53:47Z

+            // Validate the Host header. A browser always sends a Host header, and a DNS rebinding
+            // request carries the attacker-controlled host name rather than a trusted host.
+            string hostHeaderValue = NormalizeHost(request.Host.Host);
+            if (string.IsNullOrEmpty(hostHeaderValue) || !trustedHosts.Contains(hostHeaderValue))


Wouldn't using Contains might cause a case were an incomplete hostHeaderValue still be accepted even though its incomplete?
For example if it were equal to local then it would still be accepted through localhost. I think we should be checking each trustedHost against the hostHeaderValue individually and ensure it is exactly the same.

RubenCerna2079 · 2026-07-29T20:56:27Z

+            }
+
+            // Validate the Origin header when present (browser-initiated cross-origin requests).
+            if (request.Headers.TryGetValue("Origin", out Microsoft.Extensions.Primitives.StringValues originValues))


nit: I think it is better to add the namespace in the using section instead of writing the complete namespace.

RubenCerna2079 · 2026-07-29T21:24:00Z

+                                    }
+
+                                    string normalizedHost = host.Trim('[', ']');
+                                    if (!string.Equals(host, "*", StringComparison.Ordinal) &&


Shouldn't we use the normalizedHost when comparing against the * sign?

RubenCerna2079 · 2026-07-29T21:24:34Z

+                if (!string.IsNullOrEmpty(originValue))
+                {
+                    if (!TryGetOriginHost(originValue, out string originHost)
+                        || !trustedHosts.Contains(originHost))


Same issue as mentioned previously with Contains

RubenCerna2079 · 2026-07-29T22:22:24Z

+            bool allowed = McpDnsRebindingProtectionMiddleware.IsRequestFromTrustedHost(
+                request, configuredAllowedHosts: null, out string reason);
+
+            Assert.IsTrue(allowed, $"Loopback host with a port should be trusted. Reason: {reason}");


nit: We should also assert the reason variable is null

RubenCerna2079 · 2026-07-29T22:27:28Z

+            bool allowed = McpDnsRebindingProtectionMiddleware.IsRequestFromTrustedHost(
+                request, configuredAllowedHosts: new List<string> { "dab.internal" }, out string reason);
+
+            Assert.IsTrue(allowed, $"Configured host should be trusted. Reason: {reason}");


nit: Same as comment above

RubenCerna2079 · 2026-07-29T22:29:40Z

+            bool allowed = McpDnsRebindingProtectionMiddleware.IsRequestFromTrustedHost(
+                request, configuredAllowedHosts: null, out string reason);
+
+            Assert.IsTrue(allowed, $"Trusted Host and Origin should be allowed. Reason: {reason}");


nit: Same as previous comment

RubenCerna2079 · 2026-07-29T22:30:20Z

+            bool allowed = McpDnsRebindingProtectionMiddleware.IsRequestFromTrustedHost(
+                request, configuredAllowedHosts: null, out _);
+
+            Assert.IsTrue(allowed, "A request with a trusted Host and no Origin should be allowed.");


nit: Same as previous comment

souvikghosh04 self-assigned this Jul 23, 2026

souvikghosh04 added this to Data API builder Jul 23, 2026

github-project-automation Bot moved this to Todo in Data API builder Jul 23, 2026

souvikghosh04 moved this from Todo to In Progress in Data API builder Jul 23, 2026

souvikghosh04 added this to the July 2026 milestone Jul 23, 2026

Exclude UserProvidedAllowedHosts from Verify snapshots

0fd59c2

The new UserProvidedAllowedHosts helper flag is not serialized to the config file, mirroring UserProvidedPath. Ignore it in the Cli.Tests and Service.Tests Verify module initializers so snapshot tests remain stable.

souvikghosh04 marked this pull request as ready for review July 24, 2026 12:01

souvikghosh04 requested a review from Aniruddh25 as a code owner July 24, 2026 12:01

Copilot AI review requested due to automatic review settings July 24, 2026 12:01

souvikghosh04 requested review from Alekhya-Polavarapu, JerryNixon, RubenCerna2079, aaronburtle, anushakolan, rusamant, sourabh1007, stuartpa and vadeveka as code owners July 24, 2026 12:01

Merge branch 'main' into mcp-allowed-hosts-validation

eaaae18

souvikghosh04 moved this from In Progress to Review In Progress in Data API builder Jul 24, 2026

souvikghosh04 added the assign-for-review label Jul 24, 2026

github-actions Bot assigned anushakolan and RubenCerna2079 Jul 24, 2026

github-actions Bot removed the assign-for-review label Jul 24, 2026

Copilot started reviewing on behalf of souvikghosh04 July 24, 2026 12:02 View session

Copilot AI reviewed Jul 24, 2026

View reviewed changes

Comment thread src/Config/Converters/McpRuntimeOptionsConverterFactory.cs Outdated

Comment thread src/Service.Tests/Configuration/McpRuntimeOptionsSerializationTests.cs Outdated

Comment thread src/Service.Tests/Configuration/McpRuntimeOptionsSerializationTests.cs Outdated

souvikghosh04 and others added 3 commits July 24, 2026 17:39

Potential fix for pull request finding

53c72e1

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

48246e0

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

2ca3131

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

souvikghosh04 and others added 4 commits July 27, 2026 11:32

format whitespace

a84136c

Merge branch 'mcp-allowed-hosts-validation' of https://github.com/Azu…

294f5a3

…re/data-api-builder into mcp-allowed-hosts-validation # Conflicts: # src/Config/Converters/McpRuntimeOptionsConverterFactory.cs

Merge branch 'main' into mcp-allowed-hosts-validation

18ee91d

Merge branch 'main' into mcp-allowed-hosts-validation

35e6c92

RubenCerna2079 requested changes Jul 29, 2026

View reviewed changes

Uh oh!

Conversation

souvikghosh04 commented Jul 23, 2026

Why

What

Behavior change

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

RubenCerna2079 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants