Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Secure Transport
Check Origin and Host headers
Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding attacks.
OWASP AISVS v1.01, requirement 10.3.3
In plain English
An MCP server listening on HTTP, including one on localhost, can be attacked from a web page in the user's browser through DNS rebinding. Check both the Origin and Host headers on every request to stop this. Each header catches cases the other misses.
What good looks like
- The Origin header is checked against an allow-list, and requests with an unexpected Origin are rejected.
- The Host header is checked separately against the names the server expects.
- Local servers bind to the loopback address (127.0.0.1) and not to all interfaces.
- The checks apply to every HTTP endpoint.
How teams usually do it
- Middleware that validates both headers before any MCP handling. Recent official MCP SDKs include DNS rebinding protection that you may need to switch on.
- Authentication on local HTTP servers too, so a rebinding attack still needs a token.
Suggested evidence
- Server configuration showing the bind address and allowed origins and hosts.
- Tests with spoofed Origin and Host values, each rejected.
Common mistakes
- Checking only one of the two headers.
- Binding a development server to 0.0.0.0.
- Assuming localhost is safe because it cannot be reached from the internet. The user's browser can reach it.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.