@modelcontextprotocol/inspector 1.0.1 → 1.0.3

package/client/dist/index.html

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-CH-qD91V.js"></script>
+    <script type="module" crossorigin src="/assets/index-C2CDzlVy.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DXy0twoH.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
@@ -42,19 +42,20 @@
     "start-client": "cd client && npm run preview",
     "test": "npm run prettier-check && cd client && npm test",
     "test-cli": "cd cli && npm run test",
+    "test-server": "cd server && npm run test",
     "test:e2e": "MCP_AUTO_OPEN_ENABLED=false npm run test:e2e --workspace=client",
     "prettier-fix": "prettier --write .",
     "prettier-check": "prettier --check .",
     "lint": "prettier --check . && cd client && npm run lint",
     "prepare": "husky && npm run build",
-    "publish-all": "npm publish --workspaces --access public && npm publish --access public",
+    "publish-all": "npm publish --workspaces --access public --tag v1-latest && npm publish --access public --tag v1-latest",
     "update-version": "node scripts/update-version.js",
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^1.0.1",
-    "@modelcontextprotocol/inspector-client": "^1.0.1",
-    "@modelcontextprotocol/inspector-server": "^1.0.1",
+    "@modelcontextprotocol/inspector-cli": "^1.0.3",
+    "@modelcontextprotocol/inspector-client": "^1.0.3",
+    "@modelcontextprotocol/inspector-server": "^1.0.3",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",
@@ -80,13 +81,20 @@
   "overrides": {
     "get-intrinsic": "1.3.0",
     "shell-quote": "^1.8.4",
-    "hono": "^4.12.25",
+    "hono": "^4.13.3",
     "form-data": "^4.0.6",
     "@babel/core@<=7.29.0": "^7.29.6",
     "esbuild@<0.28.1": "^0.28.1",
     "minimatch@<3.1.4": "3.1.5",
-    "js-yaml@<4": "3.15.0",
-    "js-yaml@>=4": "4.2.0"
+    "js-yaml@<4": "3.15.1",
+    "js-yaml@>=4": "4.3.1",
+    "@hono/node-server@<1.19.15": "^1.19.15",
+    "ip-address@<=10.3.0": "^10.5.0",
+    "fast-uri@<3.1.5": "^3.1.5",
+    "brace-expansion@<2": "^1.1.18",
+    "brace-expansion@>=4": "^5.0.9",
+    "nanoid@<3.3.18": "^3.3.18",
+    "postcss@<=8.5.22": "^8.5.26"
   },
   "engines": {
     "node": ">=22.7.5"
@@ -95,5 +103,9 @@
     "**/*.{js,ts,jsx,tsx,json,md}": [
       "prettier --write"
     ]
+  },
+  "allowScripts": {
+    "esbuild": false,
+    "fsevents": false
   }
 }

package/server/build/env-flags.js

@@ -0,0 +1,21 @@
+/**
+ * Strict parsing for the proxy's boolean `DANGEROUSLY_*` environment flags.
+ *
+ * Each of those flags weakens a security control, so it must take an explicit
+ * opt-in to turn one on: a typo, `false`, `0` or an empty value has to leave
+ * the control enforcing rather than read as "set". One parser serves every
+ * such flag so they cannot drift apart in what they accept.
+ */
+const TRUTHY_FLAG_VALUES = new Set(["true", "1", "yes"]);
+/**
+ * Whether a flag's value is an explicit opt-in.
+ *
+ * Only `true`, `1` or `yes` (case-insensitive, surrounding whitespace ignored)
+ * count. Anything else (unset, empty, `false`, `0`, or an unrecognized value)
+ * returns false.
+ */
+export function isExplicitTruthyFlag(value) {
+    if (value === undefined)
+        return false;
+    return TRUTHY_FLAG_VALUES.has(value.trim().toLowerCase());
+}

package/server/build/fetch-metadata.js

@@ -0,0 +1,47 @@
+/**
+ * Fetch-metadata check for the proxy's API routes.
+ *
+ * The Inspector client is always served from a different origin than the
+ * proxy (its own port, `CLIENT_PORT`, default 6274, versus `SERVER_PORT`,
+ * default 6277), so a legitimate browser request to an API route is never
+ * `Sec-Fetch-Site: same-origin`. The only documents the proxy itself serves
+ * are the MCP Apps sandbox (`/sandbox`) and the untrusted app HTML it hosts in
+ * an inner frame, which inherits that origin. Those documents have no reason
+ * to call the API routes, and because a same-origin request carries no
+ * `Origin` header, the origin allow-list cannot stop them. This check does.
+ *
+ * Non-browser callers (the CLI, curl, node fetch) send no `Sec-Fetch-Site`
+ * header and are unaffected. `same-site` is deliberately allowed: ports do not
+ * count toward a site, so the real client on `localhost:6274` calling the
+ * proxy on `localhost:6277` is `same-site`.
+ *
+ * Deployments that serve the client and the proxy from one origin (a single
+ * reverse proxy routing by path) can opt out with
+ * `DANGEROUSLY_ALLOW_SAME_ORIGIN_API=true`.
+ */
+import { isExplicitTruthyFlag } from "./env-flags.js";
+export function isSameOriginBrowserRequest(headers) {
+    // Browsers set this header themselves and page script cannot override it
+    // (Sec-* names are forbidden request headers).
+    return headers["sec-fetch-site"]?.trim().toLowerCase() === "same-origin";
+}
+/**
+ * Parses the value of `DANGEROUSLY_ALLOW_SAME_ORIGIN_API`.
+ *
+ * Only an explicit truthy value (`true`, `1` or `yes`, case-insensitive,
+ * surrounding whitespace ignored) disables the same-origin check. Anything
+ * else (unset, empty, `false`, `0`, or an unrecognized value) keeps it
+ * enforcing. It shares its parser with `DANGEROUSLY_OMIT_AUTH`
+ * (`isAuthDisabledFlag` in request-guards.ts) through env-flags.ts, so the two
+ * flags accept exactly the same values.
+ */
+export function isSameOriginApiAllowedFlag(value) {
+    return isExplicitTruthyFlag(value);
+}
+/**
+ * Whether an API request must be rejected: it is a same-origin browser
+ * request and the opt-out is not enabled.
+ */
+export function shouldRejectSameOriginRequest(headers, allowSameOriginApi) {
+    return !allowSameOriginApi && isSameOriginBrowserRequest(headers);
+}

package/server/build/index.js

@@ -3,6 +3,9 @@ import cors from "cors";
 import { parseArgs } from "node:util";
 import { parse as shellParseArgs } from "shell-quote";
 import nodeFetch, { Headers as NodeHeaders } from "node-fetch";
+import { assertSafeProxyTarget, createPinnedAgent, ProxyTargetError, } from "./proxy-security.js";
+import { createOriginValidationMiddleware, isAuthDisabledFlag, } from "./request-guards.js";
+import { readCappedBody, ProxyResponseTooLargeError, } from "./proxy-response.js";
 // Type-compatible wrappers for node-fetch to work with browser-style types
 const fetch = nodeFetch;
 const Headers = NodeHeaders;
@@ -15,9 +18,10 @@ import express from "express";
 import rateLimit from "express-rate-limit";
 import { findActualExecutable } from "spawn-rx";
 import mcpProxy from "./mcpProxy.js";
+import { nextRedirectRequest, normalizeProxyHeaders, } from "./proxy-redirect.js";
+import { formatHeaderNamesForLog, formatQueryForLog } from "./log-format.js";
+import { isSameOriginApiAllowedFlag } from "./fetch-metadata.js";
 import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
-import { lookup as dnsLookup } from "node:dns/promises";
-import { isIP } from "node:net";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
 import { readFileSync } from "fs";
@@ -179,26 +183,13 @@ const serverTransports = new Map(); // Server Transports by web app sessionId
 const sessionHeaderHolders = new Map(); // For dynamic header updates
 // Use provided token from environment or generate a new one
 const sessionToken = process.env.MCP_PROXY_AUTH_TOKEN || randomBytes(32).toString("hex");
-const authDisabled = !!process.env.DANGEROUSLY_OMIT_AUTH;
-// Origin validation middleware to prevent DNS rebinding attacks
-const originValidationMiddleware = (req, res, next) => {
-    const origin = req.headers.origin;
-    // Default origins based on CLIENT_PORT or use environment variable
-    const clientPort = process.env.CLIENT_PORT || "6274";
-    const defaultOrigin = `http://localhost:${clientPort}`;
-    const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || [
-        defaultOrigin,
-    ];
-    if (origin && !allowedOrigins.includes(origin)) {
-        console.error(`Invalid origin: ${origin}`);
-        res.status(403).json({
-            error: "Forbidden - invalid origin",
-            message: "Request blocked to prevent DNS rebinding attacks. Configure allowed origins via environment variable.",
-        });
-        return;
-    }
-    next();
-};
+const authDisabled = isAuthDisabledFlag(process.env.DANGEROUSLY_OMIT_AUTH);
+const allowSameOriginApi = isSameOriginApiAllowedFlag(process.env.DANGEROUSLY_ALLOW_SAME_ORIGIN_API);
+// Origin validation middleware to prevent DNS rebinding attacks. When auth is
+// disabled it also rejects requests that carry no Origin header, and unless
+// DANGEROUSLY_ALLOW_SAME_ORIGIN_API is set it rejects same-origin browser
+// requests (see fetch-metadata.ts).
+const originValidationMiddleware = createOriginValidationMiddleware(authDisabled, allowSameOriginApi);
 const authMiddleware = (req, res, next) => {
     if (authDisabled) {
         return next();
@@ -335,7 +326,7 @@ const createCustomFetch = (headerHolder) => {
 };
 const createTransport = async (req) => {
     const query = req.query;
-    console.log("Query parameters:", JSON.stringify(query));
+    console.log("Query parameters:", formatQueryForLog(query));
     const transportType = query.transportType;
     if (transportType === "stdio") {
         const command = query.command.trim();
@@ -358,7 +349,7 @@ const createTransport = async (req) => {
         const headers = getHttpHeaders(req);
         headers["Accept"] = "text/event-stream";
         const headerHolder = { headers };
-        console.log(`SSE transport: url=${url}, headers=${JSON.stringify(headers)}`);
+        console.log(`SSE transport: url=${url}, headers=${formatHeaderNamesForLog(headers)}`);
         const transport = new SSEClientTransport(new URL(url), {
             eventSourceInit: {
                 fetch: createCustomFetch(headerHolder),
@@ -675,110 +666,51 @@ app.get("/health", (req, res) => {
         status: "ok",
     });
 });
-// Raised when the /fetch proxy is asked to reach a disallowed target, so the
-// route can distinguish an SSRF rejection (403) from an upstream failure (500).
-class ProxyTargetError extends Error {
-}
 const MAX_PROXY_REDIRECTS = 5;
-// The /fetch proxy is used by the client to reach OAuth discovery/token
-// endpoints on the connected MCP server (bypassing browser CORS). Connecting
-// to loopback and RFC1918/private LAN hosts is a core use case (testing local
-// or self-hosted MCP servers), so those stay reachable. We only block
-// link-local addresses — 169.254.0.0/16 (the AWS/GCP/Azure/etc. cloud metadata
-// endpoint 169.254.169.254 lives here) and IPv6 link-local / the AWS IPv6 IMDS
-// address — which are never legitimate proxy targets and are the real SSRF
-// exfiltration vector.
-function isBlockedProxyAddress(ip) {
-    const kind = isIP(ip);
-    if (kind === 4) {
-        const parts = ip.split(".").map(Number);
-        // 169.254.0.0/16 — IPv4 link-local (incl. cloud metadata 169.254.169.254)
-        return parts[0] === 169 && parts[1] === 254;
-    }
-    if (kind === 6) {
-        const addr = ip.toLowerCase();
-        // IPv4-mapped IPv6 (::ffff:x). The WHATWG URL parser serializes the embedded
-        // IPv4 in hex (::ffff:a9fe:a9fe for 169.254.169.254), while DNS and other
-        // sources may use the dotted form (::ffff:169.254.169.254) — handle both by
-        // extracting the IPv4 and re-checking it.
-        const mapped = addr.match(/^::ffff:(.+)$/);
-        if (mapped) {
-            const tail = mapped[1];
-            if (isIP(tail) === 4) {
-                return isBlockedProxyAddress(tail);
-            }
-            const hex = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
-            if (hex) {
-                const high = parseInt(hex[1], 16);
-                const low = parseInt(hex[2], 16);
-                return isBlockedProxyAddress(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);
-            }
-        }
-        // fe80::/10 — IPv6 link-local
-        if (/^fe[89ab]/.test(addr)) {
-            return true;
-        }
-        // fd00:ec2::254 — AWS IPv6 instance metadata endpoint
-        return addr === "fd00:ec2::254";
-    }
-    return false;
-}
-// Resolves the target host and rejects it if any resolved address is a blocked
-// (link-local/metadata) address, mitigating SSRF including the DNS case where a
-// hostname resolves to the cloud metadata IP.
-async function assertSafeProxyTarget(parsedUrl) {
-    const host = parsedUrl.hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
-    let addresses;
-    if (isIP(host)) {
-        addresses = [host];
-    }
-    else {
-        try {
-            addresses = (await dnsLookup(host, { all: true })).map((r) => r.address);
-        }
-        catch {
-            throw new ProxyTargetError(`Could not resolve host: ${host}`);
-        }
-    }
-    if (addresses.length === 0) {
-        throw new ProxyTargetError(`Could not resolve host: ${host}`);
-    }
-    for (const address of addresses) {
-        if (isBlockedProxyAddress(address)) {
-            throw new ProxyTargetError(`Refusing to proxy request to blocked address (${address})`);
-        }
-    }
-}
 // Fetch that follows redirects manually so every hop's target is re-validated
 // against assertSafeProxyTarget — otherwise an allowed host could redirect the
 // proxy into a blocked internal/metadata address.
+//
+// On each hop we call assertSafeProxyTarget (which resolves DNS and validates
+// every returned IP) and then pass a createPinnedAgent to node-fetch so it
+// connects to the IP we just validated instead of re-resolving the hostname.
+// This eliminates the TOCTOU window between the block-list check and the
+// actual TCP connection that a DNS-rebinding attack would exploit.
+//
+// What each redirect does to the next hop's request — dropping credentials
+// when the origin changes, and the 301/302/303 method and body rewrite — is
+// nextRedirectRequest in proxy-redirect.ts.
 async function safeProxyFetch(initialUrl, init) {
-    let currentUrl = new URL(initialUrl);
-    let method = init?.method ?? "GET";
-    let body = init?.body;
-    const headers = init?.headers ?? {};
+    let request = {
+        url: new URL(initialUrl),
+        method: init?.method ?? "GET",
+        body: init?.body,
+        headers: normalizeProxyHeaders(init?.headers),
+    };
     for (let hop = 0; hop <= MAX_PROXY_REDIRECTS; hop++) {
+        const currentUrl = request.url;
         if (!["http:", "https:"].includes(currentUrl.protocol)) {
             throw new ProxyTargetError("Only http/https URLs are allowed");
         }
-        await assertSafeProxyTarget(currentUrl);
+        // Resolve DNS once, validate every address, and pin the connection to that
+        // validated set so node-fetch never does a second DNS lookup. All of them
+        // are passed through, so Node's address-family fallback still works while
+        // the reachable set stays limited to what was just validated.
+        const validatedAddresses = await assertSafeProxyTarget(currentUrl);
+        const agent = createPinnedAgent(currentUrl.protocol, validatedAddresses);
         const response = await fetch(currentUrl.toString(), {
-            method,
-            headers,
-            body,
+            method: request.method,
+            headers: request.headers,
+            body: request.body,
             redirect: "manual",
+            agent,
         });
         if (response.status >= 300 && response.status < 400) {
             const location = response.headers.get("location");
             if (!location) {
                 return response;
             }
-            currentUrl = new URL(location, currentUrl);
-            // Mirror browser/fetch semantics: 301/302/303 downgrade to a bodyless GET.
-            if ([301, 302, 303].includes(response.status)) {
-                method = "GET";
-                body = undefined;
-            }
+            request = nextRedirectRequest(request, response.status, location);
             continue;
         }
         return response;
@@ -815,7 +747,20 @@ app.post("/fetch", express.json(), originValidationMiddleware, authMiddleware, a
             }
             throw error;
         }
-        const responseBody = await response.text();
+        // Read the body through a byte cap rather than response.text(), which
+        // would buffer whatever the upstream sends. An oversize body is an
+        // upstream failure, reported to the client as 502 Bad Gateway.
+        let responseBody;
+        try {
+            responseBody = await readCappedBody(response);
+        }
+        catch (error) {
+            if (error instanceof ProxyResponseTooLargeError) {
+                res.status(502).json({ error: error.message });
+                return;
+            }
+            throw error;
+        }
         const headers = {};
         response.headers.forEach((value, key) => {
             headers[key] = value;
@@ -877,6 +822,12 @@ server.on("listening", () => {
     else {
         console.log(`⚠️  WARNING: Authentication is disabled. This is not recommended.`);
     }
+    if (allowSameOriginApi) {
+        console.log(`⚠️  WARNING: DANGEROUSLY_ALLOW_SAME_ORIGIN_API is set. Same-origin browser ` +
+            `requests to the proxy API are allowed, including from documents the ` +
+            `proxy serves itself (the MCP Apps sandbox). Opening MCP App links with ` +
+            `noopener in the client is the only remaining layer.`);
+    }
 });
 server.on("error", (err) => {
     if (err.message.includes(`EADDRINUSE`)) {

package/server/build/log-format.js

@@ -0,0 +1,48 @@
+/**
+ * Formatting helpers for the proxy's diagnostic log lines.
+ *
+ * Extracted from index.ts so they can be unit-tested independently (index.ts
+ * starts the server on import).
+ *
+ * The header object built for an upstream connection carries the values the
+ * user supplied for that server — `Authorization`, and any custom headers
+ * named through `x-custom-auth-header(s)` — and the stdio `env` query
+ * parameter carries the environment the user configured for a local server.
+ * Both are forwarded on purpose, but stdout is a different audience (terminal
+ * scrollback, container log drivers, CI capture), so the log lines describe
+ * them by NAME only and never print a value.
+ */
+/**
+ * Returns the header names of `headers` as a JSON array, without any values.
+ */
+export function formatHeaderNamesForLog(headers) {
+    return JSON.stringify(Object.keys(headers));
+}
+/**
+ * Returns a JSON rendering of the request query in which the `env` parameter
+ * is reduced to its variable names. An `env` that is not a JSON object is
+ * replaced by a fixed placeholder rather than echoed.
+ */
+export function formatQueryForLog(query) {
+    if (!("env" in query)) {
+        return JSON.stringify(query);
+    }
+    return JSON.stringify({ ...query, env: describeEnv(query.env) });
+}
+function describeEnv(env) {
+    if (typeof env !== "string") {
+        return "[omitted]";
+    }
+    try {
+        const parsed = JSON.parse(env);
+        if (parsed !== null &&
+            typeof parsed === "object" &&
+            !Array.isArray(parsed)) {
+            return `[names: ${Object.keys(parsed).join(", ")}]`;
+        }
+    }
+    catch {
+        // Fall through to the placeholder: an unparseable value is still not logged.
+    }
+    return "[omitted]";
+}

package/server/build/proxy-redirect.js

@@ -0,0 +1,123 @@
+/**
+ * Redirect-hop rules for the `/fetch` proxy's manual redirect loop.
+ *
+ * `safeProxyFetch` (index.ts) follows redirects itself, with
+ * `redirect: "manual"`, so every hop can be re-validated against the SSRF
+ * guard and pinned to the addresses it resolved. Taking redirects away from
+ * the fetch library also took away the request rewriting the library did on
+ * each hop, so that rewriting lives here, as one pure function per hop:
+ *
+ *  - **Credentials stay with their origin.** When a hop changes origin —
+ *    scheme, host or port — `Authorization`, `Proxy-Authorization`, `Cookie`,
+ *    `Cookie2` and `WWW-Authenticate` are dropped, matching the Fetch
+ *    standard's "HTTP-redirect fetch" step and node-fetch's own redirect
+ *    handling. An https→http downgrade is an origin change, so it is covered.
+ *    Header names are compared case-insensitively.
+ *  - **Method and body follow the Fetch standard.** A 301/302 turns a POST
+ *    into a bodyless GET; a 303 turns anything but GET/HEAD into a bodyless
+ *    GET; 307/308 keep both. When the body is dropped, the headers describing
+ *    it go with it.
+ *
+ *  - **A body never crosses an origin boundary.** A cross-origin hop that
+ *    would still carry a body after that rewrite — a 307/308 of a POST, say —
+ *    is refused rather than followed, since a proxied body is typically an
+ *    OAuth form holding a refresh token or client secret. A 301/302/303 that
+ *    rewrites to a bodyless GET is followed (with credentials dropped), and a
+ *    same-origin 307/308 keeps its body as the standard says.
+ *
+ * Every hop gets a fresh headers object, so the caller's input is never
+ * mutated and a header dropped on one hop cannot reappear on a later one.
+ */
+import { ProxyTargetError } from "./proxy-security.js";
+/** Headers that carry credentials and must not cross an origin boundary. */
+const CREDENTIAL_HEADERS = new Set([
+    "authorization",
+    "proxy-authorization",
+    "cookie",
+    "cookie2",
+    "www-authenticate",
+]);
+/**
+ * Headers that describe the request body. They are dropped together with the
+ * body, so a rewritten GET does not announce a body it no longer has (a stale
+ * `Content-Length` would leave the upstream waiting for bytes never sent).
+ */
+const BODY_HEADERS = new Set([
+    "content-type",
+    "content-length",
+    "content-encoding",
+    "content-language",
+    "content-location",
+]);
+/**
+ * Copies the caller-supplied `init.headers` into a plain string record. The
+ * route receives them as JSON, so anything that is not a string-valued plain
+ * object entry is ignored rather than handed to the fetch library.
+ */
+export function normalizeProxyHeaders(raw) {
+    const headers = {};
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        return headers;
+    }
+    for (const [name, value] of Object.entries(raw)) {
+        if (typeof value === "string") {
+            headers[name] = value;
+        }
+    }
+    return headers;
+}
+function withoutHeaders(headers, names) {
+    const kept = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (!names.has(name.toLowerCase())) {
+            kept[name] = value;
+        }
+    }
+    return kept;
+}
+/**
+ * Whether the Fetch standard rewrites this redirect into a bodyless GET:
+ * 301/302 do so for POST only, 303 for every method except GET and HEAD.
+ */
+function rewritesToGet(status, method) {
+    const upper = method.toUpperCase();
+    if (status === 301 || status === 302) {
+        return upper === "POST";
+    }
+    if (status === 303) {
+        return upper !== "GET" && upper !== "HEAD";
+    }
+    return false;
+}
+/**
+ * Builds the request for the hop that follows a redirect response.
+ *
+ * @param current  the request that just received the redirect
+ * @param status   the redirect response's status code
+ * @param location the redirect response's `Location` header value
+ * @returns the next hop's request; the SSRF guard still has to validate its
+ *          URL before it is fetched
+ * @throws ProxyTargetError when the hop changes origin and would still carry
+ *         a body — the same refusal (403) the route returns for a blocked
+ *         target
+ */
+export function nextRedirectRequest(current, status, location) {
+    const url = new URL(location, current.url);
+    let { method, body } = current;
+    let headers = { ...current.headers };
+    const crossOrigin = url.origin !== current.url.origin;
+    if (crossOrigin) {
+        headers = withoutHeaders(headers, CREDENTIAL_HEADERS);
+    }
+    if (rewritesToGet(status, method)) {
+        method = "GET";
+        body = undefined;
+        headers = withoutHeaders(headers, BODY_HEADERS);
+    }
+    // `!= null`: the body arrives as JSON, so "no body" can be null as well as
+    // undefined. An empty string is still a body the caller chose to send.
+    if (crossOrigin && body != null) {
+        throw new ProxyTargetError("Refusing to follow a cross-origin redirect for a request with a body");
+    }
+    return { url, method, body, headers };
+}

package/server/build/proxy-response.js

@@ -0,0 +1,81 @@
+/**
+ * Bounded body reading for the /fetch reverse proxy.
+ *
+ * Extracted from index.ts so it can be unit-tested independently, alongside
+ * proxy-security.ts.
+ *
+ * /fetch buffers the upstream response in full, because it hands the body back
+ * to the browser inside a JSON envelope. Reading it with `response.text()`
+ * puts no ceiling on that buffer, so an upstream that streams (or announces)
+ * an arbitrarily large body grows the proxy's memory without limit. This
+ * module reads the body through its stream instead and stops at a fixed cap.
+ */
+/**
+ * Largest upstream response body /fetch will buffer, in bytes (5 MiB).
+ *
+ * The proxy exists to carry OAuth traffic past browser CORS restrictions:
+ * protected-resource and authorization-server metadata, client registration
+ * and token responses. Those documents are a few kilobytes at most, so 5 MiB
+ * leaves three orders of magnitude of headroom for any legitimate response
+ * while keeping the per-request buffer small enough that concurrent requests
+ * cannot exhaust the process.
+ */
+export const MAX_PROXY_RESPONSE_BYTES = 5 * 1024 * 1024;
+/** Thrown when an upstream response body exceeds the configured cap. */
+export class ProxyResponseTooLargeError extends Error {
+    constructor(maxBytes) {
+        super(`Upstream response body exceeds the ${maxBytes}-byte limit`);
+        this.name = "ProxyResponseTooLargeError";
+    }
+}
+/**
+ * Reads `response`'s body as UTF-8 text, refusing to buffer more than
+ * `maxBytes`.
+ *
+ * - A `Content-Length` larger than the cap is rejected before any of the body
+ *   is read.
+ * - Otherwise the body is accumulated chunk by chunk, and the moment the
+ *   running total passes the cap the stream is destroyed and the read fails.
+ *   `destroy()` is synchronous and is deliberately not awaited on anything:
+ *   waiting for a stream to acknowledge teardown can block indefinitely if the
+ *   source never settles.
+ *
+ * Throws {@link ProxyResponseTooLargeError} in both cases.
+ */
+export async function readCappedBody(response, maxBytes = MAX_PROXY_RESPONSE_BYTES) {
+    const { body } = response;
+    const contentLength = response.headers.get("content-length");
+    if (contentLength !== null) {
+        const declared = Number(contentLength);
+        if (Number.isFinite(declared) && declared > maxBytes) {
+            body?.destroy?.();
+            throw new ProxyResponseTooLargeError(maxBytes);
+        }
+    }
+    if (body === null) {
+        return "";
+    }
+    // Iterate by hand rather than with `for await`: leaving a `for await` loop
+    // early awaits the iterator's `return()`, which is exactly the teardown wait
+    // described above. On overflow we destroy the stream and walk away.
+    const iterator = body[Symbol.asyncIterator]();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await iterator.next();
+        if (done) {
+            break;
+        }
+        const chunk = typeof value === "string" ? Buffer.from(value) : value;
+        total += chunk.byteLength;
+        if (total > maxBytes) {
+            body.destroy?.();
+            throw new ProxyResponseTooLargeError(maxBytes);
+        }
+        chunks.push(chunk);
+    }
+    // Decode the way node-fetch's response.text() does (a default TextDecoder),
+    // so a leading UTF-8 BOM is still stripped; Buffer#toString would keep it
+    // and break JSON.parse on BOM-prefixed documents downstream.
+    return new TextDecoder().decode(Buffer.concat(chunks));
+}