|
| 1 | +/** |
| 2 | + * Redirects across the MCP SDK and our SSRF guard, over real loopback sockets. |
| 3 | + * Nothing between the SDK and the wire is mocked: two local servers on different |
| 4 | + * ports are two origins, and loopback is reachable under the self-hosted profile. |
| 5 | + */ |
| 6 | +import { createServer, type IncomingHttpHeaders, type Server } from 'node:http' |
| 7 | +import type { AddressInfo, Socket } from 'node:net' |
| 8 | +import { exchangeAuthorization } from '@modelcontextprotocol/sdk/client/auth.js' |
| 9 | +import { ServerError } from '@modelcontextprotocol/sdk/server/auth/errors.js' |
| 10 | +import { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js' |
| 11 | +import { afterEach, describe, expect, it, vi } from 'vitest' |
| 12 | +import { McpClient } from '@/lib/mcp/client' |
| 13 | +import { createSsrfGuardedMcpFetch } from '@/lib/mcp/pinned-fetch' |
| 14 | + |
| 15 | +interface RecordedRequest { |
| 16 | + method: string |
| 17 | + url: string |
| 18 | + headers: IncomingHttpHeaders |
| 19 | +} |
| 20 | + |
| 21 | +interface LocalServer { |
| 22 | + origin: string |
| 23 | + requests: RecordedRequest[] |
| 24 | + openSockets: Set<Socket> |
| 25 | + close: () => Promise<void> |
| 26 | +} |
| 27 | + |
| 28 | +type Handler = ( |
| 29 | + request: RecordedRequest, |
| 30 | + body: string, |
| 31 | + respond: (status: number, headers: Record<string, string>, body?: string) => void |
| 32 | +) => void |
| 33 | + |
| 34 | +const servers: LocalServer[] = [] |
| 35 | + |
| 36 | +async function startServer(handler: Handler): Promise<LocalServer> { |
| 37 | + const requests: RecordedRequest[] = [] |
| 38 | + const openSockets = new Set<Socket>() |
| 39 | + const server: Server = createServer((req, res) => { |
| 40 | + const chunks: Buffer[] = [] |
| 41 | + req.on('data', (chunk: Buffer) => chunks.push(chunk)) |
| 42 | + req.on('end', () => { |
| 43 | + const recorded = { method: req.method ?? '', url: req.url ?? '', headers: req.headers } |
| 44 | + requests.push(recorded) |
| 45 | + handler(recorded, Buffer.concat(chunks).toString('utf8'), (status, headers, body) => { |
| 46 | + res.writeHead(status, headers) |
| 47 | + if (body === undefined) res.flushHeaders() |
| 48 | + else res.end(body) |
| 49 | + }) |
| 50 | + }) |
| 51 | + }) |
| 52 | + server.on('connection', (socket) => { |
| 53 | + openSockets.add(socket) |
| 54 | + socket.on('close', () => openSockets.delete(socket)) |
| 55 | + }) |
| 56 | + await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve)) |
| 57 | + const { port } = server.address() as AddressInfo |
| 58 | + const local: LocalServer = { |
| 59 | + origin: `http://127.0.0.1:${port}`, |
| 60 | + requests, |
| 61 | + openSockets, |
| 62 | + close: () => |
| 63 | + new Promise<void>((resolve) => { |
| 64 | + server.closeAllConnections() |
| 65 | + server.close(() => resolve()) |
| 66 | + }), |
| 67 | + } |
| 68 | + servers.push(local) |
| 69 | + return local |
| 70 | +} |
| 71 | + |
| 72 | +afterEach(async () => { |
| 73 | + await Promise.all(servers.splice(0).map((server) => server.close())) |
| 74 | +}) |
| 75 | + |
| 76 | +describe('MCP transport redirects', () => { |
| 77 | + it('follows a cross-origin redirect of the SSE stream through the guard, without the configured credentials', async () => { |
| 78 | + const www = await startServer((_request, _body, respond) => { |
| 79 | + respond(200, { 'content-type': 'text/event-stream' }) |
| 80 | + }) |
| 81 | + const apex = await startServer((request, body, respond) => { |
| 82 | + if (request.method === 'GET') { |
| 83 | + respond(302, { location: `${www.origin}/mcp` }, '') |
| 84 | + return |
| 85 | + } |
| 86 | + if (request.method === 'DELETE') { |
| 87 | + respond(200, {}, '') |
| 88 | + return |
| 89 | + } |
| 90 | + const message = JSON.parse(body) as { id?: number; method: string } |
| 91 | + if (message.method !== 'initialize') { |
| 92 | + respond(202, {}, '') |
| 93 | + return |
| 94 | + } |
| 95 | + respond( |
| 96 | + 200, |
| 97 | + { 'content-type': 'application/json', 'mcp-session-id': 'session-1' }, |
| 98 | + JSON.stringify({ |
| 99 | + jsonrpc: '2.0', |
| 100 | + id: message.id, |
| 101 | + result: { |
| 102 | + protocolVersion: LATEST_PROTOCOL_VERSION, |
| 103 | + capabilities: {}, |
| 104 | + serverInfo: { name: 'apex', version: '1.0.0' }, |
| 105 | + }, |
| 106 | + }) |
| 107 | + ) |
| 108 | + }) |
| 109 | + |
| 110 | + const client = new McpClient({ |
| 111 | + config: { |
| 112 | + id: 'server-1', |
| 113 | + name: 'Apex', |
| 114 | + transport: 'streamable-http', |
| 115 | + url: `${apex.origin}/mcp`, |
| 116 | + headers: { Authorization: 'Bearer configured-secret', 'X-Api-Key': 'configured-key' }, |
| 117 | + }, |
| 118 | + }) |
| 119 | + try { |
| 120 | + await client.connect() |
| 121 | + await vi.waitFor(() => expect(www.requests).toHaveLength(1), { timeout: 5_000 }) |
| 122 | + } finally { |
| 123 | + await client.disconnect() |
| 124 | + } |
| 125 | + |
| 126 | + const apexStream = apex.requests.find((request) => request.method === 'GET') |
| 127 | + expect(apexStream?.headers.authorization).toBe('Bearer configured-secret') |
| 128 | + const [redirected] = www.requests |
| 129 | + expect(redirected.method).toBe('GET') |
| 130 | + expect(redirected.url).toBe('/mcp') |
| 131 | + expect(redirected.headers.authorization).toBeUndefined() |
| 132 | + expect(redirected.headers['x-api-key']).toBeUndefined() |
| 133 | + expect(redirected.headers['mcp-session-id']).toBeUndefined() |
| 134 | + }) |
| 135 | +}) |
| 136 | + |
| 137 | +describe('guarded MCP OAuth fetch', () => { |
| 138 | + it('hands an unfollowed cross-origin token redirect back to the SDK, naming its target, and releases the socket', async () => { |
| 139 | + const elsewhere = await startServer((_request, _body, respond) => respond(200, {}, '{}')) |
| 140 | + const authServer = await startServer((_request, _body, respond) => { |
| 141 | + respond(302, { location: `${elsewhere.origin}/token` }, 'moved') |
| 142 | + }) |
| 143 | + |
| 144 | + const exchange = exchangeAuthorization(authServer.origin, { |
| 145 | + metadata: { |
| 146 | + issuer: authServer.origin, |
| 147 | + authorization_endpoint: `${authServer.origin}/authorize`, |
| 148 | + token_endpoint: `${authServer.origin}/token`, |
| 149 | + response_types_supported: ['code'], |
| 150 | + }, |
| 151 | + clientInformation: { client_id: 'client-1' }, |
| 152 | + authorizationCode: 'code-1', |
| 153 | + codeVerifier: 'verifier-1', |
| 154 | + redirectUri: 'http://127.0.0.1/callback', |
| 155 | + fetchFn: createSsrfGuardedMcpFetch({ |
| 156 | + serverUrl: `${authServer.origin}/mcp`, |
| 157 | + timeoutMs: 5_000, |
| 158 | + }), |
| 159 | + }) |
| 160 | + |
| 161 | + const error = await exchange.catch((caught: unknown) => caught) |
| 162 | + expect(error).toBeInstanceOf(ServerError) |
| 163 | + expect((error as Error).message).toBe( |
| 164 | + `HTTP 302: Redirect to ${elsewhere.origin}/token not followed` |
| 165 | + ) |
| 166 | + expect(authServer.requests.map((request) => request.method)).toEqual(['POST']) |
| 167 | + expect(elsewhere.requests).toHaveLength(0) |
| 168 | + await vi.waitFor(() => expect(authServer.openSockets.size).toBe(0), { timeout: 2_000 }) |
| 169 | + }) |
| 170 | +}) |
0 commit comments