charlesmamane26-sketch 6c9d5c55ad Security: cap MCP HTTP request bodies and add optional Origin allowlist (#280) ...

Reject request bodies above 16 MiB with 413 before allocating, stopping an
unauthenticated Content-Length OOM (vec![0u8; len]). Add an optional,
default-off OBSCURA_MCP_ALLOWED_ORIGINS allowlist; unset keeps the permissive
default so issue #175 hosted dashboards are unaffected.

2026-06-10 19:10:18 +00:00

..

cors_preflight.rs

Security: cap MCP HTTP request bodies and add optional Origin allowlist (#280)

2026-06-10 19:10:18 +00:00