MCP TypeScript SDK (V2) / @modelcontextprotocol/server / server/middleware/hostHeaderValidation
server/middleware/hostHeaderValidation
Type Aliases
HostHeaderValidationResult
HostHeaderValidationResult = {
hostname:string;ok:true; } | {errorCode:"missing_host"|"invalid_host_header"|"invalid_host";hostHeader?:string;hostname?:string;message:string;ok:false; }
Defined in: packages/server/src/server/middleware/hostHeaderValidation.ts:1
Functions
hostHeaderValidationResponse()
hostHeaderValidationResponse(
req,allowedHostnames):Response|undefined
Defined in: packages/server/src/server/middleware/hostHeaderValidation.ts:51
Web-standard Request helper for DNS rebinding protection.
Parameters
req
Request
allowedHostnames
string[]
Returns
Response | undefined
Example
const result = validateHostHeader(req.headers.get('host'), ['localhost']);localhostAllowedHostnames()
localhostAllowedHostnames():
string[]
Defined in: packages/server/src/server/middleware/hostHeaderValidation.ts:40
Convenience allowlist for localhost DNS rebinding protection.
Returns
string[]
validateHostHeader()
validateHostHeader(
hostHeader,allowedHostnames):HostHeaderValidationResult
Defined in: packages/server/src/server/middleware/hostHeaderValidation.ts:17
Parse and validate a Host header against an allowlist of hostnames (port-agnostic).
- Input host header may include a port (e.g.
localhost:3000) or IPv6 brackets (e.g.[::1]:3000). - Allowlist items should be hostnames only (no ports). For IPv6, include brackets (e.g.
[::1]).
Parameters
hostHeader
string | null | undefined
allowedHostnames
string[]