user2595/codex-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(mcp): disable DNS rebinding protection for LAN HTTP transport

Browse Source 
FastMCP defaults to DNS rebinding protection (allowed_hosts=localhost only),
which rejects requests from the Mac (192.168.178.82) to the Jetson
(192.168.178.103:8765). Security is already provided by Bearer token auth
in _TokenAuth middleware and UFW restricting port 8765 to trusted LAN IPs,
making host-header validation redundant in this deployment context.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Tarik Moussa
2026-06-14 14:55:29 +02:00
parent 1d1203b225
commit d29dcf2fb5
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
codex/mcp_server.py
View File

@@ -26,10 +26,16 @@ from __future__ import annotations
import logging
from mcp.server.fastmcp import FastMCP
from mcp.server.transport_security import TransportSecuritySettings
logger = logging.getLogger(__name__)
mcp = FastMCP("codex")
# DNS rebinding protection disabled: the server is guarded by Bearer token auth
# (mcp_server.py _TokenAuth middleware) and UFW firewall (trusted LAN IPs only).
mcp = FastMCP(
"codex",
transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False),
)
# ---------------------------------------------------------------------------