{"record":{"id":"53b937d81bc93bc4","repo":"Hmbown/CodeWhale","slug":"mcp-sse-endpoint-is-not-same-origin-as-ref","errorCode":null,"errorMessage":"MCP SSE endpoint {} is not same-origin as {} — refusing to send authenticated requests cross-origin","messagePattern":"MCP SSE endpoint (.+?) is not same-origin as (.+?) — refusing to send authenticated requests cross-origin","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/mcp/sse.rs","lineNumber":260,"sourceCode":"        let base = reqwest::Url::parse(base_url)?;\n        let resolved =\n            if endpoint_url.starts_with(\"http://\") || endpoint_url.starts_with(\"https://\") {\n                reqwest::Url::parse(endpoint_url)?\n            } else {\n                base.join(endpoint_url)?\n            };\n        // Security: the server-supplied `endpoint` event must stay same-origin\n        // as the connect URL. The connect host is vetted by network policy\n        // once, but the endpoint host is never re-checked — so an absolute\n        // cross-origin endpoint would let a malicious MCP server redirect the\n        // client's *authenticated* POSTs (Bearer/OAuth headers attached) to an\n        // internal host (169.254.169.254, localhost admin ports, …): an SSRF /\n        // policy bypass. Relative endpoints are same-origin by construction.\n        if resolved.scheme() != base.scheme()\n            || resolved.host_str() != base.host_str()\n            || resolved.port_or_known_default() != base.port_or_known_default()\n        {\n            anyhow::bail!(\n                \"MCP SSE endpoint {} is not same-origin as {} — refusing to send \\\n                 authenticated requests cross-origin\",\n                mask_url_secrets(resolved.as_str()),\n                mask_url_secrets(base.as_str()),\n            );\n        }\n        Ok(resolved.to_string())\n    }\n}\n\n#[async_trait::async_trait]\nimpl McpTransport for SseTransport {\n    async fn send(&mut self, msg: Vec<u8>) -> Result<()> {\n        let endpoint = self\n            .endpoint_url\n            .as_ref()\n            .context(\"SSE endpoint not yet discovered\")?\n            .clone();","sourceCodeStart":242,"sourceCodeEnd":278,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/8880682c63083a91624de936797efa3ce9e498fd/crates/tui/src/mcp/sse.rs#L242-L278","documentation":"Security guard: the endpoint event's URL resolved to a different origin (scheme, host, or port) than the connect URL. Because authenticated POSTs (Bearer/OAuth headers) target that endpoint, a cross-origin value would let a malicious MCP server redirect the client's credentials at internal hosts (169.254.169.254, localhost admin ports) — an SSRF/policy bypass. Relative endpoints are same-origin by construction and always pass.","triggerScenarios":"The server sends `event: endpoint` with an absolute URL on another origin — e.g. connect to https://mcp.example.com but endpoint data: http://169.254.169.254/latest or http://127.0.0.1:8081/messages.","commonSituations":"Misconfigured server advertising an internal or admin origin; load balancers rewriting the advertised endpoint to a different host/port; genuinely malicious servers probing for SSRF.","solutions":["Fix the server to send a relative endpoint path (e.g. /messages?sessionId=...) or an absolute URL with the same scheme, host, and port as the connect URL","If the server legitimately moved, change the configured MCP server URL to the new origin rather than the endpoint event","Treat unexpected cross-origin endpoints as a security finding in the server, never as a client bug to bypass"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"```rust\nfn is_cross_origin_refusal(err: &anyhow::Error) -> bool {\n    format!(\"{err:#}\").contains(\"is not same-origin as\")\n}\n```","tryCatchPattern":"```rust\nErr(e) if is_cross_origin_refusal(&e) => {\n    // Security: the server tried to redirect authenticated POSTs off-origin.\n    report_untrusted_server(&server_name, &e); // never bypass; surface prominently\n    return Err(e);\n}\n```","preventionTips":["Prefer MCP servers that advertise relative endpoint paths","Never relax the same-origin check; treat trips as a finding against the server and report to its operator"],"tags":["mcp","sse","security","ssrf"],"backgroundTag":null,"analyzedSha":"8880682c63083a91624de936797efa3ce9e498fd","analyzedAt":"2026-08-16T11:31:27.956Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}