Class Nexus\Mcp\Server\Transport\Http\Middleware\DnsRebindingProtectionMiddleware

`final`
`readonly`
`implements`	`MiddlewareInterface`

Guards the MCP endpoint against DNS rebinding by rejecting requests from an unrecognised Origin or Host. A present-but-unlisted Origin is answered with an id-less JSON-RPC error on HTTP 403. A request without an Origin header (non-browser clients) passes through, since only browsers send it. Host validation is a beyond-spec, opt-in dimension: an empty allow-list disables it, otherwise the Host header must be present and listed. Matching is case-insensitive, since RFC 9110 makes the scheme and host of a URI so.

Located at Server/Transport/Http/Middleware/DnsRebindingProtectionMiddleware.php

Methods


					
	public

__construct(
	list<non-empty-string> $allowedOrigins,
	list<non-empty-string> $allowedHosts,
	ResponseFactoryInterface $responseFactory,
	StreamFactoryInterface $streamFactory,
)

Parameters

`$allowedOrigins`	Origins permitted to reach the endpoint, or `['*']` to allow any
`$allowedHosts`	Hosts permitted to reach the endpoint (empty disables `Host` validation), or `['*']` to allow any


					
	public

process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface

Namespaces

Classes

Class Nexus\Mcp\Server\Transport\Http\Middleware\DnsRebindingProtectionMiddleware

Parameters