René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"streamable_http client does not send `Origin` header → rejected with 403 by spec-compliant servers (e.g. go-sdk `CrossOriginProtection`)","articleBody":"## Summary\n\nThe Python SDK's `streamable_http_client` opens its POST handshake without an `Origin` header (and without `Sec-Fetch-Site`). The official Go SDK (`modelcontextprotocol/go-sdk` v1.4.x) wraps every streamable-HTTP handler with Go 1.25's stdlib `http.CrossOriginProtection`, which enforces the spec's anti-DNS-rebinding rule and **denies any state-changing request that cannot prove same-origin** via one of:\n\n- `Sec-Fetch-Site: same-origin | same-site | none` (browser-only), or\n- An `Origin` header whose host matches the server's `Host`, or\n- An origin explicitly listed via `CrossOriginProtection.AddTrustedOrigin`.\n\nSince the Python client sends none of those, a perfectly legitimate server-to-server connection from the official Python client to the official Go server is indistinguishable from a CSRF attempt → **HTTP 403 Forbidden** on the very first POST.\n\nSo the two reference SDKs from the same org are out of sync by one spec revision: the Go server enforces the new rule; the Python client doesn't yet send the headers that satisfy it.\n\n## Reproduction\n\n**Server** — a Go MCP server built with `modelcontextprotocol/go-sdk@v1.4.1` and the standard handler:\n\n```go\nhandler := mcp.NewStreamableHTTPHandler(\n    func(_ *http.Request) *mcp.Server { return srv },\n    nil, // default CrossOriginProtection: deny non-same-origin\n)\nhttp.Handle(\"/mcp\", handler)\n```\n\n**Client** — Python `mcp` SDK:\n\n```python\nfrom mcp.client.streamable_http import streamablehttp_client\nfrom mcp.client.session import ClientSession\n\nasync with streamablehttp_client(\"http://my-go-server:8081/mcp\") as (read, write, _):\n    async with ClientSession(read, write) as session:\n        await session.initialize()   # never completes\n```\n\n**Observed:**\n\n1. `httpx` POSTs to `/mcp` with no `Origin` header, no `Sec-Fetch-*` headers.\n2. Go server returns `HTTP/1.1 403 Forbidden` immediately.\n3. Python client `post_writer` swallows the non-2xx (see #2110), and `session.initialize()` hangs forever on the read stream.\n4. Eventually the caller (e.g. a FastAPI startup hook with a `wait_for` timeout) cancels, which surfaces as `RuntimeError: Attempted to exit cancel scope in a different task than it was entered in` because the `streamable_http_client` task group was entered in one task and is being torn down in another.\n\n**Expected:** the Python client should send an `Origin` header derived from the target URL by default, so a spec-compliant server accepts the handshake.\n\n## Workarounds (today)\n\n- **Server side, Go**: pass `\u0026mcp.StreamableHTTPHandlerOptions{CrossOriginProtection: cop}` with `cop.AddTrustedOrigin(...)`, or set `GODEBUG=disablecrossoriginprotection=1`. Both require code/env changes on every server deployment.\n- **Client side, Python**: monkey-patch the httpx client to inject `Origin`. Brittle; depends on internals of `streamable_http`.\n\nNeither is satisfactory if both reference SDKs are supposed to interoperate out of the box.\n\n## Suggested fix\n\nIn `mcp.client.streamable_http`, when opening the `httpx.AsyncClient`, derive a default `Origin` header from the target URL's scheme + netloc and add it to every outgoing request:\n\n```python\nparsed = urlparse(self.url)\ndefault_origin = f\"{parsed.scheme}://{parsed.netloc}\"\nheaders.setdefault(\"Origin\", default_origin)\n```\n\nThis makes the Python client's traffic indistinguishable from a same-origin browser request as far as `CrossOriginProtection.Check` is concerned, without weakening any server's CSRF posture. Callers who *want* a different `Origin` (e.g. multi-tenant proxies) can still override via the existing custom-headers path.\n\nOptionally, also set `Sec-Fetch-Site: same-origin` so the Go middleware short-circuits on the cheaper check.\n\n## Related\n\n- #2110 — explains why the resulting 403 manifests as a client hang instead of a clean exception.\n- #1798 / #861 — the Python *server* added equivalent DNS-rebinding protection; the *client* never picked up the matching header behavior.\n\n## Environment\n\n- `mcp` (Python SDK): latest installed via `mcp \u003e= 1.x` (tested under Locus's `locus.integrations.fastmcp.MCPClient` wrapper, which is a thin pass-through to `streamablehttp_client`).\n- `modelcontextprotocol/go-sdk@v1.4.1` (server).\n- Go 1.25 (stdlib `http.CrossOriginProtection`).\n- Python 3.13, anyio 4.x.","author":{"url":"https://github.com/fede-kamel","@type":"Person","name":"fede-kamel"},"datePublished":"2026-05-30T02:44:31.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/2727/python-sdk/issues/2727"}