fix(server): compare Host and Origin case-insensitively

RFC 9110 makes the scheme and host case-insensitive, and every WHATWG-URL
client - fetch, undici, browsers, and so mcp-remote - lowercases the host
before sending it. TransportSecurityMiddleware compared it byte for byte.

On Windows that is the default way into the bug rather than an edge case:
%COMPUTERNAME% is always uppercase, so deriving allowed_hosts from the machine
name yields MYHOST:*, clients send host: myhost:8000, and the server answers
421 to everything while configured exactly as intended.

_validate_origin had the same comparison, and an origin is a scheme and a
host with no path, so both sides fold. The header is kept as sent for the
warning line; only the comparison folds, and a host differing by more than
case still fails.

Fixes #3437

Author: drexthealpha

src/mcp/server/transport_security.py

@@ -53,17 +53,24 @@ def _validate_host(self, host: str | None) -> bool:
             logger.warning("Missing Host header in request")
             return False
 
+        # RFC 9110: the host is case-insensitive. Clients built on WHATWG URL parsing
+        # (fetch, undici, browsers) lowercase it before sending, so an `allowed_hosts`
+        # entry derived from something uppercase - %COMPUTERNAME% on Windows always is -
+        # never matches, and the server 421s while configured exactly as intended.
+        # The header is compared folded; `host` is kept as sent for the log line.
+        folded = host.lower()
+
         # Check exact match first
-        if host in self.settings.allowed_hosts:
+        if folded in [allowed.lower() for allowed in self.settings.allowed_hosts]:
             return True
 
         # Check wildcard port patterns
         for allowed in self.settings.allowed_hosts:
             if allowed.endswith(":*"):
                 # Extract base host from pattern
-                base_host = allowed[:-2]
+                base_host = allowed[:-2].lower()
                 # Check if the actual host starts with base host and has a port
-                if host.startswith(base_host + ":"):
+                if folded.startswith(base_host + ":"):
                     return True
 
         logger.warning(f"Invalid Host header: {host}")
@@ -75,17 +82,21 @@ def _validate_origin(self, origin: str | None) -> bool:
         if not origin:
             return True
 
+        # Same rule, same reason: an origin is a scheme and a host, and RFC 9110 makes
+        # both case-insensitive. There is no path here to compare case-sensitively.
+        folded = origin.lower()
+
         # Check exact match first
-        if origin in self.settings.allowed_origins:
+        if folded in [allowed.lower() for allowed in self.settings.allowed_origins]:
             return True
 
         # Check wildcard port patterns
         for allowed in self.settings.allowed_origins:
             if allowed.endswith(":*"):
                 # Extract base origin from pattern
-                base_origin = allowed[:-2]
+                base_origin = allowed[:-2].lower()
                 # Check if the actual origin starts with base origin and has a port
-                if origin.startswith(base_origin + ":"):
+                if folded.startswith(base_origin + ":"):
                     return True
 
         logger.warning(f"Invalid Origin header: {origin}")

tests/server/test_transport_security.py

@@ -45,6 +45,12 @@ def _request(host: str | None, origin: str | None, content_type: str | None = "a
         pytest.param("good.example", "http://evil.example:9000", 403, id="origin-wildcard-base-mismatch"),
         pytest.param("good.example", "http://good.example", None, id="origin-exact"),
         pytest.param("good.example", "http://wild.example:9000", None, id="origin-wildcard-match"),
+        # RFC 9110: scheme and host are case-insensitive, and WHATWG-URL clients
+        # (fetch, undici, browsers) send them lowercased whatever was configured.
+        pytest.param("GOOD.EXAMPLE", None, None, id="host-exact-differing-case"),
+        pytest.param("WILD.EXAMPLE:9000", None, None, id="host-wildcard-differing-case"),
+        pytest.param("good.example", "http://GOOD.EXAMPLE", None, id="origin-exact-differing-case"),
+        pytest.param("good.example", "http://WILD.EXAMPLE:9000", None, id="origin-wildcard-differing-case"),
     ],
 )
 async def test_validate_request_checks_host_then_origin(
@@ -56,6 +62,41 @@ async def test_validate_request_checks_host_then_origin(
     assert (None if response is None else response.status_code) == expected
 
 
+@pytest.mark.anyio
+@pytest.mark.parametrize(
+    ("host", "origin"),
+    [
+        pytest.param("myhost", None, id="host-exact"),
+        pytest.param("myhost:8000", None, id="host-wildcard"),
+        pytest.param("myhost", "http://myhost", id="origin-exact"),
+        pytest.param("myhost", "http://myhost:8000", id="origin-wildcard"),
+    ],
+)
+async def test_an_uppercase_allowlist_still_matches_what_clients_send(host: str, origin: str | None) -> None:
+    """The reported path: %COMPUTERNAME% is always uppercase on Windows.
+
+    Deriving the allowlist from the machine name is the obvious thing to do and
+    yields entries like `MYHOST:*`; every fetch-based client then sends
+    `host: myhost:8000`, and the server 421s while configured exactly as intended.
+    """
+    settings = TransportSecuritySettings(
+        enable_dns_rebinding_protection=True,
+        allowed_hosts=["MYHOST", "MYHOST:*"],
+        allowed_origins=["http://MYHOST", "http://MYHOST:*"],
+    )
+    middleware = TransportSecurityMiddleware(settings)
+    assert await middleware.validate_request(_request(host, origin)) is None
+
+
+@pytest.mark.anyio
+async def test_case_folding_does_not_widen_the_allowlist() -> None:
+    """Folding case must not make a host match that differs by more than case."""
+    middleware = TransportSecurityMiddleware(SETTINGS)
+    for host in ("EVIL.EXAMPLE", "good.example.evil.example", "GOOD.EXAMPLEX"):
+        response = await middleware.validate_request(_request(host, None))
+        assert response is not None and response.status_code == 421, host
+
+
 @pytest.mark.anyio
 async def test_validate_request_skips_host_and_origin_when_protection_is_disabled() -> None:
     """With DNS-rebinding protection off, any Host/Origin is accepted."""