-
Notifications
You must be signed in to change notification settings - Fork 1.6k
examples: restrict demo CORS origins to localhost #1499
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
examples: restrict demo CORS origins to localhost #1499
Conversation
|
@modelcontextprotocol/client
@modelcontextprotocol/server
@modelcontextprotocol/express
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
|
CI note: failed due to pkg.pr.new returning HTTP 500 (Cloudflare worker exception) in the publish step, not due to the code changes. + tests + conformance are green. |
|
Correction: the failing check is "pkg-publish"; "build" + tests + conformance are green (pkg.pr.new returned HTTP 500 during publish). |
|
FYI: the |
Several browser-facing examples configured CORS as
origin: '*'(and in one case alsocredentials: true). While convenient, this is a common copy/paste footgun if the example server is ever exposed beyond localhost.This PR keeps the intended “works out of the box for local dev / Inspector direct connect” behavior by restricting demo CORS origins to localhost/127.0.0.1/[::1] (any port).
Updated examples:
origin: '*'+credentials: true)cors()defaults)Developers who intentionally expose these demos remotely can widen the allowlist as needed.