pub fn authenticate_for(
auth: &McpAuthState,
headers: &HeaderMap,
authority: Option<&str>,
) -> Result<McpPrincipal, AuthFailure>Expand description
Resolves the principal for a request from its headers, taking the request
authority (Host, or the HTTP/2 :authority) from authority.
An Origin header is accepted when it is allow-listed or when its
authority equals the request’s own authority (the embedded web UI calling
/mcp on whatever hostname it was served from). Cross-site pages fail
both tests. Under DNS rebinding both values name the attacker’s domain and
the request reaches the endpoint — but without the bearer token, which a
foreign origin cannot read from this origin’s storage, it is still 401.