examples: restrict demo CORS origins to localhost#1499
examples: restrict demo CORS origins to localhost#1499TheodorNEngoy wants to merge 5 commits intomodelcontextprotocol:mainfrom
Conversation
|
@modelcontextprotocol/client
@modelcontextprotocol/server
@modelcontextprotocol/express
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
|
CI note: failed due to pkg.pr.new returning HTTP 500 (Cloudflare worker exception) in the publish step, not due to the code changes. + tests + conformance are green. |
|
Correction: the failing check is "pkg-publish"; "build" + tests + conformance are green (pkg.pr.new returned HTTP 500 during publish). |
|
FYI: the |
Several browser-facing examples configured CORS as
origin: '*'(and in one case alsocredentials: true). While convenient, this is a common copy/paste footgun if the example server is ever exposed beyond localhost.This PR keeps the intended “works out of the box for local dev / Inspector direct connect” behavior by restricting demo CORS origins to localhost/127.0.0.1/[::1] (any port).
Updated examples:
origin: '*'+credentials: true)cors()defaults)Developers who intentionally expose these demos remotely can widen the allowlist as needed.