mirror of
https://github.com/googleapis/genai-toolbox.git
synced 2026-05-02 03:00:36 -04:00
d00b6fdf18
Update error code from 400 to 403 according to MCP [updates](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1439) for invalid origin header. Also updated hostCheck to only check host, not port. To test, run Toolbox with the following (also work with port number e.g. `--allowed-host=127.0.0.1:5000`): ``` go run . --allowed-hosts=127.0.0.1 ``` Test with the following: ``` // curl successfully curl -H "Host: 127.0.0.1:5000" http://127.0.0.1:5000 // curl successfully curl -H "Host: 127.0.0.1:3000" http://127.0.0.1:5000 // will show Invalid Host Header error curl -H "Host: attacker:5000" http://127.0.0.1:5000 ```