user 6df38ecc1d chore(mcp): close redirect-bypass + name-lookup variants of the SSRF/IP gating ... Two follow-ups to address Veria-AI findings on the PR. (1) Disable redirect-following on the OAuth outbound POSTs. validate_url only inspects the initial URL; httpx clients default to follow_redirects=True, so a malicious 30x from the validated host could bounce the proxy to an internal target. Add follow_redirects to the AsyncHTTPHandler.post wrapper (mirroring the existing get) and pass follow_redirects=False from both /token and /register flows. (2) Make get_mcp_server_by_name fail closed on None client_ip. The wrapper previously translated None to INTERNAL_REQUEST internally to preserve the "None means internal" convention, but that meant any external request handler that forgot to pass an IP silently bypassed gating. Update the wrapper to require an explicit sentinel for internal callers; update the four external callers in auth/user_api_key_auth_mcp.py and rest_endpoints.py to pass INTERNAL_REQUEST (where the lookup is metadata-only) or the real extracted client_ip. Adjust the test fixture in test_discoverable_endpoints.py to return INTERNAL_REQUEST instead of None so OAuth flow tests bypass IP gating explicitly. Update two stub lambdas in test_rest_endpoints.py to accept the new client_ip kwarg (CLAUDE.md: keep monkeypatch stubs in sync with real signatures).		2026-05-11 20:14:48 +00:00
..
mcp_server	chore(mcp): close redirect-bypass + name-lookup variants of the SSRF/IP gating	2026-05-11 20:14:48 +00:00