TestMCPUnauthenticatedRejectedEndToEnd locks in the security boundary that makes disabling the SDK's rebinding check safe (BYT-9693): a request without a valid bearer token is rejected with 401 by authMiddleware before it ever reaches the MCP handler, regardless of Host. Network position is not the
(t *testing.T)
| 188 | // the token is. A DNS-rebinding attacker — who cannot obtain the token — is |
| 189 | // stopped here, so the disabled rebinding check protects nothing it must. |
| 190 | func TestMCPUnauthenticatedRejectedEndToEnd(t *testing.T) { |
| 191 | secret := "test-secret-key" |
| 192 | profile := &config.Profile{Mode: common.ReleaseModeDev, ExternalURL: "https://bb.example.com"} |
| 193 | |
| 194 | s, err := NewServer(nil, profile, secret) |
| 195 | require.NoError(t, err) |
| 196 | |
| 197 | e := echo.New() |
| 198 | s.RegisterRoutes(e) |
| 199 | ts := httptest.NewServer(e) |
| 200 | defer ts.Close() |
| 201 | |
| 202 | req, err := http.NewRequest(http.MethodPost, ts.URL+"/mcp", strings.NewReader(`{}`)) |
| 203 | require.NoError(t, err) |
| 204 | req.Header.Set("Content-Type", "application/json") |
| 205 | req.Host = "bb.example.com" |
| 206 | |
| 207 | resp, err := ts.Client().Do(req) |
| 208 | require.NoError(t, err) |
| 209 | defer resp.Body.Close() |
| 210 | |
| 211 | require.Equal(t, http.StatusUnauthorized, resp.StatusCode) |
| 212 | } |
| 213 | |
| 214 | func generateValidToken(t *testing.T, secret string) string { |
| 215 | t.Helper() |