Follow-up from code review on the MCP server feature (#50).
Three small hardening items that don't fix bugs today but close future-contributor footguns.
- Origin header is allowed to be missing on POST /mcp (
mcp/src/oauth/middleware.ts:33-44). MCP spec requires Origin validation to prevent DNS rebinding. For HTTPS-fronted endpoints behind Cloudflare Tunnel this is much harder to exploit, but tightening to "require Origin on POST /mcp" in production is one line.
- WWW-Authenticate
description is not CRLF-stripped (mcp/src/oauth/middleware.ts:104-112). All current callers pass static strings; defense-in-depth for future contributors who pass user input.
- bearerAuth validates but doesn't attach identity to context (
mcp/src/oauth/middleware.ts:73-98). The record (github_user, scope, client_id) is discarded after validation. Add c.set('auth', {...}) so future per-user audit logs / rate limits don't have to redo the DB lookup.
Source: review of feature/mcp-server-#50.
Follow-up from code review on the MCP server feature (#50).
Three small hardening items that don't fix bugs today but close future-contributor footguns.
mcp/src/oauth/middleware.ts:33-44). MCP spec requires Origin validation to prevent DNS rebinding. For HTTPS-fronted endpoints behind Cloudflare Tunnel this is much harder to exploit, but tightening to "require Origin on POST /mcp" in production is one line.descriptionis not CRLF-stripped (mcp/src/oauth/middleware.ts:104-112). All current callers pass static strings; defense-in-depth for future contributors who pass user input.mcp/src/oauth/middleware.ts:73-98). Therecord(github_user, scope, client_id) is discarded after validation. Addc.set('auth', {...})so future per-user audit logs / rate limits don't have to redo the DB lookup.Source: review of feature/mcp-server-#50.