From 820b65cca032fea399a25c4a5fb6db5324a79d6c Mon Sep 17 00:00:00 2001 From: Koichi ITO Date: Thu, 15 Oct 2026 17:13:59 +0900 Subject: [PATCH] Allow the end-to-end test's host under DNS rebinding protection ## Motivation and Context `MCP::Server::OAuth::EndToEndTest` drives the SDK's HTTP client against a Rack stack through WebMock's `to_rack`, which until WebMock 3.32 passed the app no `Host` header. WebMock 3.34.0 fills `HTTP_HOST` in from the request URL, so the transport's DNS rebinding protection, on by default, now refuses `mcp.example.com` with `403 Forbidden: Invalid Host header`, and the test errors with "You are forbidden to make initialize requests" on every CI run since that release. The test now builds the transport with `allowed_hosts: ["mcp.example.com"]`, as a deployment serving that host would, so it passes with either WebMock. The library is unchanged. ## How Has This Been Tested? `test/mcp/server/oauth/end_to_end_test.rb` with WebMock 3.34.0, where it errored before, and with WebMock 3.26.4, where it passed before and still does. ## Breaking Changes None. --- test/mcp/server/oauth/end_to_end_test.rb | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/test/mcp/server/oauth/end_to_end_test.rb b/test/mcp/server/oauth/end_to_end_test.rb index 30577626..d6c5a3dd 100644 --- a/test/mcp/server/oauth/end_to_end_test.rb +++ b/test/mcp/server/oauth/end_to_end_test.rb @@ -46,7 +46,14 @@ def setup WhoamiTool.observations.clear @server = MCP::Server.new(name: "e2e_server", tools: [WhoamiTool]) - @transport = Transports::StreamableHTTPTransport.new(@server, enable_json_response: true) + # The transport serves `mcp.example.com`, so the host is allow-listed as a deployment there would: + # DNS rebinding protection rejects any other `Host`, and WebMock 3.34 and later hand the Rack app + # the host of the request URL. + @transport = Transports::StreamableHTTPTransport.new( + @server, + enable_json_response: true, + allowed_hosts: [URI(MCP_URL).host], + ) @metadata = ProtectedResourceMetadata.new( resource: MCP_URL,