Class McpOriginPolicy

Namespace

MailFathom.Infrastructure.Security.Transport

Assembly

MailFathom.Infrastructure.dll

Which browser origins the MCP endpoint answers.

public sealed class McpOriginPolicy

Inheritance

object

McpOriginPolicy

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The MCP Streamable HTTP transport requires a server to validate the Origin header, because a page the user never visited can otherwise make a browser send authenticated requests to an address it resolved back to the operator's own host. That check is what this type owns, and it is deliberately separate from the CORS response headers: CORS tells a browser what it may read, whereas this decides whether the request is served at all.

It is not authentication and must never be mistaken for it. A non-browser client sends no Origin at all and is served exactly as before, and any client that chooses its own headers can send whichever origin it likes. The value of the check is confined to the one attacker it is aimed at: a browser, which sets the header itself and does not let a page forge it.

Properties

AllowedOrigins

Gets the origins this policy serves, in their normalized form, empty when every origin is served.

AllowingAnyOrigin

Gets the policy that serves every origin, which is what a deployment configuring none receives.

AllowsAnyOrigin

Gets whether every origin is served.

ServingNoBrowserOrigin

Gets the policy that serves no browser at all, which a deployment states by configuring an empty origin list.

Methods

Permits(string?)

Gets whether a request carrying a given Origin is served.

Restricting(IEnumerable<string>)

Creates a policy that serves an exact set of origins.

TryNormalize(string?, out string)

Normalizes a configured origin into the form a browser sends.