DNS rebinding protection

[rahul-infotech676]

Pre-submission Checklist

• I have checked that this question would not be more appropriate as an issue in a specific repository
• I have searched existing discussions and documentation for answers

Question Category

• Protocol Specification
• SDK Usage
• Server Implementation
• General Implementation
• Documentation
• Other

Your Question

The v1.4.0 version has introduced DNS rebinding protection

To be able to access my local development environment via a custom domain ( dev.local.com ), I create a DNS lookup locally to point localhost to dev.local.com, but with above update this causes it to break as reaching dev.local.com gives 403 or forbidden error.
Updating the server for one of the option DisableLocalhostProtection to true or using MCPGODEBUG env variable bypasses this and resolves my issue since for this case it's not exactly a rebinding attack

As part of release notes for v1.40, the Introduced DNS rebinding protection section states that The option to remove this protection will be removed in v1.6.0. But the question what exactly will be removed ? The DisableLocalhostProtection param or support for MCPGODEBUG env variable or both ?

[connyay]

I have the same question. I deploy some services in various network topologies and in some configurations (especially local dev) we will need to opt out of this protection - completly removing the option would be quite painful.

[maciej-kisiel]

It looks like there was a duplicate discussion creation. Let's continue it in #831.