Skip to content

Commit ab90083

Browse files
ddworkenddworken
committed
Invert variable to improve code readability
1 parent 970905c commit ab90083

File tree

5 files changed

+35
-28
lines changed

5 files changed

+35
-28
lines changed

‎README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ app.post('/mcp', async (req, res) => {
254254
},
255255
// DNS rebinding protection is disabled by default for backwards compatibility. If you are running this server
256256
// locally, make sure to set:
257-
// disableDnsRebindingProtection: true,
257+
// enableDnsRebindingProtection: true,
258258
// allowedHosts: ['127.0.0.1'],
259259
});
260260

@@ -399,7 +399,7 @@ The Streamable HTTP transport includes DNS rebinding protection to prevent secur
399399
```typescript
400400
const transport = new StreamableHTTPServerTransport({
401401
sessionIdGenerator: () => randomUUID(),
402-
disableDnsRebindingProtection: false,
402+
enableDnsRebindingProtection: true,
403403

404404
allowedHosts: ['127.0.0.1', ...],
405405
allowedOrigins: ['https://yourdomain.com', 'https://www.yourdomain.com']

‎src/server/sse.test.ts

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ describe('SSEServerTransport', () => {
125125
const mockRes = createMockResponse();
126126
const transport = new SSEServerTransport('/messages', mockRes, {
127127
allowedHosts: ['localhost:3000', 'example.com'],
128+
enableDnsRebindingProtection: true,
128129
});
129130
await transport.start();
130131

@@ -144,6 +145,7 @@ describe('SSEServerTransport', () => {
144145
const mockRes = createMockResponse();
145146
const transport = new SSEServerTransport('/messages', mockRes, {
146147
allowedHosts: ['localhost:3000'],
148+
enableDnsRebindingProtection: true,
147149
});
148150
await transport.start();
149151

@@ -163,6 +165,7 @@ describe('SSEServerTransport', () => {
163165
const mockRes = createMockResponse();
164166
const transport = new SSEServerTransport('/messages', mockRes, {
165167
allowedHosts: ['localhost:3000'],
168+
enableDnsRebindingProtection: true,
166169
});
167170
await transport.start();
168171

@@ -183,6 +186,7 @@ describe('SSEServerTransport', () => {
183186
const mockRes = createMockResponse();
184187
const transport = new SSEServerTransport('/messages', mockRes, {
185188
allowedOrigins: ['http://localhost:3000', 'https://example.com'],
189+
enableDnsRebindingProtection: true,
186190
});
187191
await transport.start();
188192

@@ -202,6 +206,7 @@ describe('SSEServerTransport', () => {
202206
const mockRes = createMockResponse();
203207
const transport = new SSEServerTransport('/messages', mockRes, {
204208
allowedOrigins: ['http://localhost:3000'],
209+
enableDnsRebindingProtection: true,
205210
});
206211
await transport.start();
207212

@@ -268,13 +273,13 @@ describe('SSEServerTransport', () => {
268273
});
269274
});
270275

271-
describe('disableDnsRebindingProtection option', () => {
272-
it('should skip all validations when disableDnsRebindingProtection is true', async () => {
276+
describe('enableDnsRebindingProtection option', () => {
277+
it('should skip all validations when enableDnsRebindingProtection is false', async () => {
273278
const mockRes = createMockResponse();
274279
const transport = new SSEServerTransport('/messages', mockRes, {
275280
allowedHosts: ['localhost:3000'],
276281
allowedOrigins: ['http://localhost:3000'],
277-
disableDnsRebindingProtection: true,
282+
enableDnsRebindingProtection: false,
278283
});
279284
await transport.start();
280285

@@ -300,6 +305,7 @@ describe('SSEServerTransport', () => {
300305
const transport = new SSEServerTransport('/messages', mockRes, {
301306
allowedHosts: ['localhost:3000'],
302307
allowedOrigins: ['http://localhost:3000'],
308+
enableDnsRebindingProtection: true,
303309
});
304310
await transport.start();
305311

‎src/server/sse.ts

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,10 @@ export interface SSEServerTransportOptions {
2626
allowedOrigins?: string[];
2727

2828
/**
29-
* Disable DNS rebinding protection entirely (overrides allowedHosts and allowedOrigins).
29+
* Enable DNS rebinding protection (requires allowedHosts and/or allowedOrigins to be configured).
30+
* Default is false for backwards compatibility.
3031
*/
31-
disableDnsRebindingProtection?: boolean;
32+
enableDnsRebindingProtection?: boolean;
3233
}
3334

3435
/**
@@ -54,16 +55,16 @@ export class SSEServerTransport implements Transport {
5455
options?: SSEServerTransportOptions,
5556
) {
5657
this._sessionId = randomUUID();
57-
this._options = options || {disableDnsRebindingProtection: true};
58+
this._options = options || {enableDnsRebindingProtection: false};
5859
}
5960

6061
/**
6162
* Validates request headers for DNS rebinding protection.
6263
* @returns Error message if validation fails, undefined if validation passes.
6364
*/
6465
private validateRequestHeaders(req: IncomingMessage): string | undefined {
65-
// Skip validation if protection is disabled
66-
if (this._options.disableDnsRebindingProtection) {
66+
// Skip validation if protection is not enabled
67+
if (!this._options.enableDnsRebindingProtection) {
6768
return undefined;
6869
}
6970

‎src/server/streamableHttp.test.ts

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1312,7 +1312,7 @@ describe("StreamableHTTPServerTransport DNS rebinding protection", () => {
13121312
const result = await createTestServerWithDnsProtection({
13131313
sessionIdGenerator: undefined,
13141314
allowedHosts: ['localhost:3001'],
1315-
disableDnsRebindingProtection: false,
1315+
enableDnsRebindingProtection: true,
13161316
});
13171317
server = result.server;
13181318
transport = result.transport;
@@ -1338,7 +1338,7 @@ describe("StreamableHTTPServerTransport DNS rebinding protection", () => {
13381338
const result = await createTestServerWithDnsProtection({
13391339
sessionIdGenerator: undefined,
13401340
allowedHosts: ['example.com:3001'],
1341-
disableDnsRebindingProtection: false,
1341+
enableDnsRebindingProtection: true,
13421342
});
13431343
server = result.server;
13441344
transport = result.transport;
@@ -1362,7 +1362,7 @@ describe("StreamableHTTPServerTransport DNS rebinding protection", () => {
13621362
const result = await createTestServerWithDnsProtection({
13631363
sessionIdGenerator: undefined,
13641364
allowedHosts: ['example.com:3001'],
1365-
disableDnsRebindingProtection: false,
1365+
enableDnsRebindingProtection: true,
13661366
});
13671367
server = result.server;
13681368
transport = result.transport;
@@ -1384,7 +1384,7 @@ describe("StreamableHTTPServerTransport DNS rebinding protection", () => {
13841384
const result = await createTestServerWithDnsProtection({
13851385
sessionIdGenerator: undefined,
13861386
allowedOrigins: ['http://localhost:3000', 'https://example.com'],
1387-
disableDnsRebindingProtection: false,
1387+
enableDnsRebindingProtection: true,
13881388
});
13891389
server = result.server;
13901390
transport = result.transport;
@@ -1407,7 +1407,7 @@ describe("StreamableHTTPServerTransport DNS rebinding protection", () => {
14071407
const result = await createTestServerWithDnsProtection({
14081408
sessionIdGenerator: undefined,
14091409
allowedOrigins: ['http://localhost:3000'],
1410-
disableDnsRebindingProtection: false,
1410+
enableDnsRebindingProtection: true,
14111411
});
14121412
server = result.server;
14131413
transport = result.transport;
@@ -1429,13 +1429,13 @@ describe("StreamableHTTPServerTransport DNS rebinding protection", () => {
14291429
});
14301430
});
14311431

1432-
describe("disableDnsRebindingProtection option", () => {
1433-
it("should skip all validations when disableDnsRebindingProtection is true", async () => {
1432+
describe("enableDnsRebindingProtection option", () => {
1433+
it("should skip all validations when enableDnsRebindingProtection is false", async () => {
14341434
const result = await createTestServerWithDnsProtection({
14351435
sessionIdGenerator: undefined,
14361436
allowedHosts: ['localhost:3001'],
14371437
allowedOrigins: ['http://localhost:3000'],
1438-
disableDnsRebindingProtection: true,
1438+
enableDnsRebindingProtection: false,
14391439
});
14401440
server = result.server;
14411441
transport = result.transport;
@@ -1463,7 +1463,7 @@ describe("StreamableHTTPServerTransport DNS rebinding protection", () => {
14631463
sessionIdGenerator: undefined,
14641464
allowedHosts: ['localhost:3001'],
14651465
allowedOrigins: ['http://localhost:3001'],
1466-
disableDnsRebindingProtection: false,
1466+
enableDnsRebindingProtection: true,
14671467
});
14681468
server = result.server;
14691469
transport = result.transport;
@@ -1507,7 +1507,7 @@ async function createTestServerWithDnsProtection(config: {
15071507
sessionIdGenerator: (() => string) | undefined;
15081508
allowedHosts?: string[];
15091509
allowedOrigins?: string[];
1510-
disableDnsRebindingProtection?: boolean;
1510+
enableDnsRebindingProtection?: boolean;
15111511
}): Promise<{
15121512
server: Server;
15131513
transport: StreamableHTTPServerTransport;
@@ -1523,7 +1523,7 @@ async function createTestServerWithDnsProtection(config: {
15231523
sessionIdGenerator: config.sessionIdGenerator,
15241524
allowedHosts: config.allowedHosts,
15251525
allowedOrigins: config.allowedOrigins,
1526-
disableDnsRebindingProtection: config.disableDnsRebindingProtection,
1526+
enableDnsRebindingProtection: config.enableDnsRebindingProtection,
15271527
});
15281528

15291529
await mcpServer.connect(transport);

‎src/server/streamableHttp.ts

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -75,10 +75,10 @@ export interface StreamableHTTPServerTransportOptions {
7575
allowedOrigins?: string[];
7676

7777
/**
78-
* Disable DNS rebinding protection entirely (overrides allowedHosts and allowedOrigins).
79-
* Default is true for backwards compatibility.
78+
* Enable DNS rebinding protection (requires allowedHosts and/or allowedOrigins to be configured).
79+
* Default is false for backwards compatibility.
8080
*/
81-
disableDnsRebindingProtection?: boolean;
81+
enableDnsRebindingProtection?: boolean;
8282
}
8383

8484
/**
@@ -129,7 +129,7 @@ export class StreamableHTTPServerTransport implements Transport {
129129
private _onsessioninitialized?: (sessionId: string) => void;
130130
private _allowedHosts?: string[];
131131
private _allowedOrigins?: string[];
132-
private _disableDnsRebindingProtection: boolean;
132+
private _enableDnsRebindingProtection: boolean;
133133

134134
sessionId?: string | undefined;
135135
onclose?: () => void;
@@ -143,7 +143,7 @@ export class StreamableHTTPServerTransport implements Transport {
143143
this._onsessioninitialized = options.onsessioninitialized;
144144
this._allowedHosts = options.allowedHosts;
145145
this._allowedOrigins = options.allowedOrigins;
146-
this._disableDnsRebindingProtection = options.disableDnsRebindingProtection ?? true;
146+
this._enableDnsRebindingProtection = options.enableDnsRebindingProtection ?? false;
147147
}
148148

149149
/**
@@ -162,8 +162,8 @@ export class StreamableHTTPServerTransport implements Transport {
162162
* @returns Error message if validation fails, undefined if validation passes.
163163
*/
164164
private validateRequestHeaders(req: IncomingMessage): string | undefined {
165-
// Skip validation if protection is disabled
166-
if (this._disableDnsRebindingProtection) {
165+
// Skip validation if protection is not enabled
166+
if (!this._enableDnsRebindingProtection) {
167167
return undefined;
168168
}
169169

0 commit comments

Comments
 (0)