Enum OriginPolicy 

pub enum OriginPolicy {
    SameOriginOrLoopback,
    AllowList(Vec<String>),
    Disabled,
}

Validation policy for the Origin request header on the MCP endpoint.

Variants

SameOriginOrLoopback

Default. Origin absent → allowed. Origin present → allowed only if its host is loopback (localhost, 127.0.0.0/8, [::1]). Anything else → HTTP 403.

The request’s Host header is not consulted: it is attacker-controlled, and a rebinding attacker sets it to agree with Origin. To serve a browser app from a non-loopback origin, name that origin with OriginPolicy::AllowList. See ADR-031 (2026-08-15).

AllowList(Vec<String>)

OriginPolicy::SameOriginOrLoopback semantics plus an explicit allowlist of origins (scheme://host[:port]; host compared case-insensitively, default-port normalized). The literal entry "null" admits Origin: null.

Disabled

No validation — for deployments that enforce origin upstream (API Gateway / ALB / reverse proxy) or are not browser-reachable.

Trait Implementations

impl Clone for OriginPolicy

fn clone(&self) -> OriginPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OriginPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OriginPolicy

fn default() -> OriginPolicy

Returns the “default value” for a type.

impl Eq for OriginPolicy

impl PartialEq for OriginPolicy

fn eq(&self, other: &OriginPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for OriginPolicy