Documentation
¶
Overview ¶
Package httpguard carries the HTTP security wrappers shared by mcpmu's two listeners — the web management UI and the serve-mode MCP endpoint:
- Host allowlisting (DNS-rebinding defence),
- Origin validation,
- constant-time bearer-token enforcement,
- refusal of tokenless non-loopback binds.
The wrappers must be installed unconditionally and outermost, independent of whether auth happens to be enabled: a page at http://evil.com can rebind DNS to 127.0.0.1 and speak same-origin to any loopback service, so a server whose protections are conditional on a token defaulting to empty has none.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func HostAndOrigin ¶
HostAndOrigin applies just the unconditional request-hygiene wrappers: Host allowlisting, then Origin validation. Authentication stays the inner middleware's business.
func Middleware ¶
Middleware nests Host validation, Origin validation, and bearer-token enforcement around next, in that order. Install it outermost — outside any logging, recovery, or auth middleware — so the checks hold for every route and every auth posture. This is the right shape for pure-bearer endpoints like serve mode; a server with its own richer authentication (cookies plus bearer) should compose HostAndOrigin around its existing auth middleware instead.
func RefuseUnsafeBind ¶
RefuseUnsafeBind rejects a tokenless bind to a non-loopback address. Serve mode exposes tools/call and the web UI exposes configuration mutation and server registration — either way, an unauthenticated network-reachable listener is arbitrary execution one DNS-rebind away. tokenHint names the ways to configure the token, e.g. "--token or MCPMU_SERVE_TOKEN".
func RequireToken ¶
RequireToken gates every request behind the bearer token. Comparison is constant-time; failures get WWW-Authenticate per RFC 6750. An empty token disables enforcement (callers must have refused a tokenless non-loopback bind via RefuseUnsafeBind).
Types ¶
type Options ¶
type Options struct {
// Addr is the configured listen address ("host:port"). A specific host
// part joins the Host allowlist so a deliberate non-loopback bind stays
// reachable by its own address; a wildcard bind falls back to accepting
// any IP-literal Host (an attacker domain is a name, never an IP).
Addr string
// Token is the bearer token required by Middleware. "" disables token
// enforcement — the Host and Origin checks above it still apply.
Token string
// AllowedOrigins are extra Origin allowlist entries beyond loopback.
AllowedOrigins []string
}
Options configures Middleware and RefuseUnsafeBind.
Source Files