diff options
| author | Peter Stone <thepeterstone@gmail.com> | 2026-07-05 04:50:42 +0000 |
|---|---|---|
| committer | Peter Stone <thepeterstone@gmail.com> | 2026-07-05 04:50:42 +0000 |
| commit | 24a87b9e979abe6c2ba23421293dc0cd8cb6d65f (patch) | |
| tree | 1ee5a1c1313da7a42c84ef361ea4ec2b8bbfb188 /internal/handlers/proxy.go | |
| parent | 081d06794a90ce45406ac1f12db9f843d8077327 (diff) | |
fix(proxy): set Host header to upstream target to satisfy loopback MCP DNS-rebinding check
mcp.NewStreamableHTTPHandler rejects requests where the server is
bound to loopback but the Host header is not (DNS-rebinding protection).
Requests proxied through doot arrived at claudomator with
Host: doot.terst.org, triggering a 403.
Set req.Host = target.Host in the ReverseProxy Director so upstream
services see the target host (e.g. 127.0.0.1:8484) rather than the
original public hostname.
Diffstat (limited to 'internal/handlers/proxy.go')
| -rw-r--r-- | internal/handlers/proxy.go | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/internal/handlers/proxy.go b/internal/handlers/proxy.go index ce10a6a..ce328ef 100644 --- a/internal/handlers/proxy.go +++ b/internal/handlers/proxy.go @@ -31,6 +31,7 @@ func NewServiceProxy(targetURL, allowedOrigin, pathPrefix string) http.Handler { Director: func(req *http.Request) { req.URL.Scheme = target.Scheme req.URL.Host = target.Host + req.Host = target.Host // use upstream host so loopback services see a loopback Host header req.URL.Path = stripPrefix(req.URL.Path) if req.URL.RawPath != "" { req.URL.RawPath = stripPrefix(req.URL.RawPath) |