feat: add allowed-origins flag #1984

Yuan325 · 2025-11-19T00:13:32Z

Support allowed-origins flag to allow secure deployment of Toolbox. Current Toolbox is insecure by default, which allows all origin (*). This PR also updated docs to notify user of the new allowed-origins flag in the Cloud Run, kubernetes, and docker deployment docs.

This PR was tested manually by mocking a browser access:

Created a HTML file with Javascript fetch named malicious-client.html:

<!DOCTYPE html>
<html>
<head>
    <title>Malicious CORS Test</title>
</head>
<body>
    <h1>Attempting to access API at http://127.0.0.1:5000/mcp</h1>
    <p>Check the **Chrome Developer Console** (F12 -> Console tab) for the result.</p>

    <script>
        fetch('http://127.0.0.1:5000/mcp', {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
                // The browser automatically adds the 'Origin' header based on where this HTML is served from (http://localhost:8000)
            },
            body: JSON.stringify({
                "jsonrpc": "2.0",
                "id": 1,
                "method": "tools/list"
            })
        })
        .then(response => {
            console.log('Success (but check console for CORS enforcement details):', response);
            return response.json();
        })
        .then(data => console.log('Data received (only if CORS passes):', data))
        .catch(error => console.error('Fetch Error:', error));
    </script>

</body>
</html>

Run python3 -m http.server 8000
Open http://localhost:8000/malicious-client.html in browser.
Tried without --allowed-origins flag -- success.
Tried with --allowed-origins=http://localhost:8000 -- success.
Tried with --allowed-origins=http://foo.com -- unsuccessful.

gemini-code-assist · 2025-11-19T00:13:53Z

Summary of Changes

Hello @Yuan325, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the security posture of the Toolbox application by implementing a new --allowed-origins flag. This flag allows users to explicitly define a list of trusted web origins that can interact with the Toolbox server, thereby mitigating potential DNS rebinding attacks and moving away from an insecure default of allowing all origins. The change is supported by comprehensive documentation updates across different deployment environments, ensuring users can easily adopt the more secure configuration.

Highlights

New Security Flag: Introduced the --allowed-origins flag to control Cross-Origin Resource Sharing (CORS) access, allowing users to specify a list of permitted origins.
Default Insecurity Addressed: The default behavior of allowing all origins (*) has been addressed by providing a mechanism for secure configuration, mitigating potential DNS rebinding attacks.
Deployment Documentation Updates: Updated documentation for Docker, Kubernetes (GKE), and Cloud Run deployments to guide users on securing their Toolbox instances with the new flag.
Manual Verification: The functionality of the new flag was manually tested and verified with various origin configurations to ensure correct behavior.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces an important security enhancement by adding an --allowed-origins flag to control Cross-Origin Resource Sharing (CORS) policies. This allows for more secure deployments of Toolbox by restricting which origins can access the server. The implementation correctly adds the new flag, integrates the go-chi/cors middleware, and includes a helpful warning when the permissive default (*) is used. The documentation has also been updated across Docker, GKE, and Cloud Run deployment guides to reflect this change. I've identified a minor but critical issue in the documentation examples where smart quotes were used, which would cause copy-pasted commands to fail. My review includes suggestions to correct this.

docs/en/how-to/deploy_toolbox.md

github-actions · 2025-11-19T00:16:22Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-1984/

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

github-actions · 2025-11-19T00:36:19Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-1984/

github-actions · 2025-11-19T03:57:02Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-1984/

cmd/root.go

Co-authored-by: Averi Kitsch <[email protected]>

github-actions · 2025-11-26T15:29:48Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-1984/

github-actions · 2025-11-27T16:49:57Z

🔎 Preview at https://googleapis.github.io/genai-toolbox/previews/PR-1984/

github-actions · 2025-11-27T17:04:45Z

🧨 Preview deployments removed.

Support `allowed-origins` flag to allow secure deployment of Toolbox. Current Toolbox is **insecure by default**, which allows all origin (`*`). This PR also updated docs to notify user of the new `allowed-origins` flag in the Cloud Run, kubernetes, and docker deployment docs. This PR was tested manually by mocking a browser access: 1. Created a HTML file with Javascript fetch named `malicious-client.html`: ``` <!DOCTYPE html> <html> <head> <title>Malicious CORS Test</title> </head> <body> <h1>Attempting to access API at http://127.0.0.1:5000/mcp</h1> <p>Check the **Chrome Developer Console** (F12 -> Console tab) for the result.</p> <script> fetch('http://127.0.0.1:5000/mcp', { method: 'POST', headers: { 'Content-Type': 'application/json', // The browser automatically adds the 'Origin' header based on where this HTML is served from (http://localhost:8000) }, body: JSON.stringify({ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }) }) .then(response => { console.log('Success (but check console for CORS enforcement details):', response); return response.json(); }) .then(data => console.log('Data received (only if CORS passes):', data)) .catch(error => console.error('Fetch Error:', error)); </script> </body> </html> ``` 2. Run `python3 -m http.server 8000` 3. Open `http://localhost:8000/malicious-client.html` in browser. 4. Tried without `--allowed-origins` flag -- success. Tried with `--allowed-origins=http://localhost:8000` -- success. Tried with `--allowed-origins=http://foo.com` -- unsuccessful. --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Averi Kitsch <[email protected]> 862868f

🤖 I have created a release *beep* *boop* --- ## [0.22.0](v0.21.0...v0.22.0) (2025-12-04) ### Features * Add allowed-origins flag ([#1984](#1984)) ([862868f](862868f)) * **tools/postgres:** Add list-query-stats and get-column-cardinality functions ([#1976](#1976)) ([9f76026](9f76026)) * **tools/spanner:** Add spanner list graphs to prebuiltconfigs ([#2056](#2056)) ([0e7fbf4](0e7fbf4)) * **prebuilt/cloud-sql:** Add clone instance tool for cloud sql ([#1845](#1845)) ([5e43630](5e43630)) * **serverless-spark:** Add create_pyspark_batch tool ([1bf0b51](1bf0b51)) * **serverless-spark:** Add create_spark_batch tool ([17a9792](17a9792)) * Support alternate accessToken header name ([#1968](#1968)) ([18017d6](18017d6)) * Support for annotations ([#2007](#2007)) ([ac21335](ac21335)) * **tool/mssql:** Set default host and port for MSSQL source ([#1943](#1943)) ([7a9cc63](7a9cc63)) * **tools/cloudsqlpg:** Add CloudSQL PostgreSQL pre-check tool ([#1722](#1722)) ([8752e05](8752e05)) * **tools/postgres-list-publication-tables:** Add new postgres-list-publication-tables tool ([#1919](#1919)) ([f4b1f0a](f4b1f0a)) * **tools/postgres-list-tablespaces:** Add new postgres-list-tablespaces tool ([#1934](#1934)) ([5ad7c61](5ad7c61)) * **tools/spanner-list-graph:** Tool impl + docs + tests ([#1923](#1923)) ([a0f44d3](a0f44d3)) ### Bug Fixes * Add import for firebirdsql ([#2045](#2045)) ([fb7aae9](fb7aae9)) * Correct FAQ to mention HTTP tools ([#2036](#2036)) ([7b44237](7b44237)) * Format BigQuery numeric output as decimal strings ([#2084](#2084)) ([155bff8](155bff8)) * Set default annotations for tools in code if annotation not provided in yaml ([#2049](#2049)) ([565460c](565460c)) * **tools/alloydb-postgres-list-tables:** Exclude google_ml schema from list_tables ([#2046](#2046)) ([a03984c](a03984c)) * **tools/alloydbcreateuser:** Remove duplication of project praram ([#2028](#2028)) ([730ac6d](730ac6d)) * **tools/mongodb:** Remove `required` tag from the `canonical` field ([#2099](#2099)) ([744214e](744214e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Wenxin Du <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [0.22.0](v0.21.0...v0.22.0) (2025-12-04) ### Features * Add allowed-origins flag ([#1984](#1984)) ([862868f](862868f)) * **tools/postgres:** Add list-query-stats and get-column-cardinality functions ([#1976](#1976)) ([9f76026](9f76026)) * **tools/spanner:** Add spanner list graphs to prebuiltconfigs ([#2056](#2056)) ([0e7fbf4](0e7fbf4)) * **prebuilt/cloud-sql:** Add clone instance tool for cloud sql ([#1845](#1845)) ([5e43630](5e43630)) * **serverless-spark:** Add create_pyspark_batch tool ([1bf0b51](1bf0b51)) * **serverless-spark:** Add create_spark_batch tool ([17a9792](17a9792)) * Support alternate accessToken header name ([#1968](#1968)) ([18017d6](18017d6)) * Support for annotations ([#2007](#2007)) ([ac21335](ac21335)) * **tool/mssql:** Set default host and port for MSSQL source ([#1943](#1943)) ([7a9cc63](7a9cc63)) * **tools/cloudsqlpg:** Add CloudSQL PostgreSQL pre-check tool ([#1722](#1722)) ([8752e05](8752e05)) * **tools/postgres-list-publication-tables:** Add new postgres-list-publication-tables tool ([#1919](#1919)) ([f4b1f0a](f4b1f0a)) * **tools/postgres-list-tablespaces:** Add new postgres-list-tablespaces tool ([#1934](#1934)) ([5ad7c61](5ad7c61)) * **tools/spanner-list-graph:** Tool impl + docs + tests ([#1923](#1923)) ([a0f44d3](a0f44d3)) ### Bug Fixes * Add import for firebirdsql ([#2045](#2045)) ([fb7aae9](fb7aae9)) * Correct FAQ to mention HTTP tools ([#2036](#2036)) ([7b44237](7b44237)) * Format BigQuery numeric output as decimal strings ([#2084](#2084)) ([155bff8](155bff8)) * Set default annotations for tools in code if annotation not provided in yaml ([#2049](#2049)) ([565460c](565460c)) * **tools/alloydb-postgres-list-tables:** Exclude google_ml schema from list_tables ([#2046](#2046)) ([a03984c](a03984c)) * **tools/alloydbcreateuser:** Remove duplication of project praram ([#2028](#2028)) ([730ac6d](730ac6d)) * **tools/mongodb:** Remove `required` tag from the `canonical` field ([#2099](#2099)) ([744214e](744214e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Wenxin Du <[email protected]> cb4529c

🤖 I have created a release *beep* *boop* --- ## [0.22.0](googleapis/genai-toolbox@v0.21.0...v0.22.0) (2025-12-04) ### Features * Add allowed-origins flag ([googleapis#1984](googleapis#1984)) ([862868f](googleapis@862868f)) * **tools/postgres:** Add list-query-stats and get-column-cardinality functions ([googleapis#1976](googleapis#1976)) ([9f76026](googleapis@9f76026)) * **tools/spanner:** Add spanner list graphs to prebuiltconfigs ([googleapis#2056](googleapis#2056)) ([0e7fbf4](googleapis@0e7fbf4)) * **prebuilt/cloud-sql:** Add clone instance tool for cloud sql ([googleapis#1845](googleapis#1845)) ([5e43630](googleapis@5e43630)) * **serverless-spark:** Add create_pyspark_batch tool ([1bf0b51](googleapis@1bf0b51)) * **serverless-spark:** Add create_spark_batch tool ([17a9792](googleapis@17a9792)) * Support alternate accessToken header name ([googleapis#1968](googleapis#1968)) ([18017d6](googleapis@18017d6)) * Support for annotations ([googleapis#2007](googleapis#2007)) ([ac21335](googleapis@ac21335)) * **tool/mssql:** Set default host and port for MSSQL source ([googleapis#1943](googleapis#1943)) ([7a9cc63](googleapis@7a9cc63)) * **tools/cloudsqlpg:** Add CloudSQL PostgreSQL pre-check tool ([googleapis#1722](googleapis#1722)) ([8752e05](googleapis@8752e05)) * **tools/postgres-list-publication-tables:** Add new postgres-list-publication-tables tool ([googleapis#1919](googleapis#1919)) ([f4b1f0a](googleapis@f4b1f0a)) * **tools/postgres-list-tablespaces:** Add new postgres-list-tablespaces tool ([googleapis#1934](googleapis#1934)) ([5ad7c61](googleapis@5ad7c61)) * **tools/spanner-list-graph:** Tool impl + docs + tests ([googleapis#1923](googleapis#1923)) ([a0f44d3](googleapis@a0f44d3)) ### Bug Fixes * Add import for firebirdsql ([googleapis#2045](googleapis#2045)) ([fb7aae9](googleapis@fb7aae9)) * Correct FAQ to mention HTTP tools ([googleapis#2036](googleapis#2036)) ([7b44237](googleapis@7b44237)) * Format BigQuery numeric output as decimal strings ([googleapis#2084](googleapis#2084)) ([155bff8](googleapis@155bff8)) * Set default annotations for tools in code if annotation not provided in yaml ([googleapis#2049](googleapis#2049)) ([565460c](googleapis@565460c)) * **tools/alloydb-postgres-list-tables:** Exclude google_ml schema from list_tables ([googleapis#2046](googleapis#2046)) ([a03984c](googleapis@a03984c)) * **tools/alloydbcreateuser:** Remove duplication of project praram ([googleapis#2028](googleapis#2028)) ([730ac6d](googleapis@730ac6d)) * **tools/mongodb:** Remove `required` tag from the `canonical` field ([googleapis#2099](googleapis#2099)) ([744214e](googleapis@744214e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Wenxin Du <[email protected]> cb4529c

🤖 I have created a release *beep* *boop* --- ## [0.22.0](v0.21.0...v0.22.0) (2025-12-04) ### Features * Add allowed-origins flag ([#1984](#1984)) ([862868f](862868f)) * **tools/postgres:** Add list-query-stats and get-column-cardinality functions ([#1976](#1976)) ([9f76026](9f76026)) * **tools/spanner:** Add spanner list graphs to prebuiltconfigs ([#2056](#2056)) ([0e7fbf4](0e7fbf4)) * **prebuilt/cloud-sql:** Add clone instance tool for cloud sql ([#1845](#1845)) ([5e43630](5e43630)) * **serverless-spark:** Add create_pyspark_batch tool ([1bf0b51](1bf0b51)) * **serverless-spark:** Add create_spark_batch tool ([17a9792](17a9792)) * Support alternate accessToken header name ([#1968](#1968)) ([18017d6](18017d6)) * Support for annotations ([#2007](#2007)) ([ac21335](ac21335)) * **tool/mssql:** Set default host and port for MSSQL source ([#1943](#1943)) ([7a9cc63](7a9cc63)) * **tools/cloudsqlpg:** Add CloudSQL PostgreSQL pre-check tool ([#1722](#1722)) ([8752e05](8752e05)) * **tools/postgres-list-publication-tables:** Add new postgres-list-publication-tables tool ([#1919](#1919)) ([f4b1f0a](f4b1f0a)) * **tools/postgres-list-tablespaces:** Add new postgres-list-tablespaces tool ([#1934](#1934)) ([5ad7c61](5ad7c61)) * **tools/spanner-list-graph:** Tool impl + docs + tests ([#1923](#1923)) ([a0f44d3](a0f44d3)) ### Bug Fixes * Add import for firebirdsql ([#2045](#2045)) ([fb7aae9](fb7aae9)) * Correct FAQ to mention HTTP tools ([#2036](#2036)) ([7b44237](7b44237)) * Format BigQuery numeric output as decimal strings ([#2084](#2084)) ([155bff8](155bff8)) * Set default annotations for tools in code if annotation not provided in yaml ([#2049](#2049)) ([565460c](565460c)) * **tools/alloydb-postgres-list-tables:** Exclude google_ml schema from list_tables ([#2046](#2046)) ([a03984c](a03984c)) * **tools/alloydbcreateuser:** Remove duplication of project praram ([#2028](#2028)) ([730ac6d](730ac6d)) * **tools/mongodb:** Remove `required` tag from the `canonical` field ([#2099](#2099)) ([744214e](744214e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Wenxin Du <[email protected]>

Yuan325 requested a review from a team as a code owner November 19, 2025 00:13

blunderbuss-gcf bot assigned duwenxin99 Nov 19, 2025

gemini-code-assist bot reviewed Nov 19, 2025

View reviewed changes

docs/en/how-to/deploy_toolbox.md Outdated Show resolved Hide resolved

docs/en/how-to/deploy_toolbox.md Outdated Show resolved Hide resolved

feat: add allowed-origin flag

fce2d46

Yuan325 force-pushed the origin-header branch from e57f3f9 to fce2d46 Compare November 19, 2025 00:33

Apply suggestions from code review

004d0ca

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Merge branch 'main' into origin-header

19d907d

Yuan325 assigned averikitsch and unassigned duwenxin99 Nov 20, 2025

averikitsch approved these changes Nov 25, 2025

View reviewed changes

cmd/root.go Outdated Show resolved Hide resolved

Yuan325 and others added 2 commits November 26, 2025 07:26

Update cmd/root.go

af721e2

Co-authored-by: Averi Kitsch <[email protected]>

Merge branch 'main' into origin-header

fd5408b

Merge branch 'main' into origin-header

d3a089c

Yuan325 enabled auto-merge (squash) November 27, 2025 16:56

Yuan325 merged commit 862868f into main Nov 27, 2025
12 checks passed

Yuan325 deleted the origin-header branch November 27, 2025 17:03

release-please bot mentioned this pull request Nov 26, 2025

chore(main): release 0.22.0 #1997

Merged

BrewTestBot mentioned this pull request Dec 5, 2025

mcp-toolbox 0.22.0 Homebrew/homebrew-core#257162

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add allowed-origins flag #1984

feat: add allowed-origins flag #1984

Uh oh!

Yuan325 commented Nov 19, 2025

Uh oh!

gemini-code-assist bot commented Nov 19, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Nov 19, 2025

Uh oh!

github-actions bot commented Nov 19, 2025

Uh oh!

github-actions bot commented Nov 19, 2025

Uh oh!

Uh oh!

github-actions bot commented Nov 26, 2025

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

feat: add allowed-origins flag #1984

feat: add allowed-origins flag #1984

Uh oh!

Conversation

Yuan325 commented Nov 19, 2025

Uh oh!

gemini-code-assist bot commented Nov 19, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Nov 19, 2025

Uh oh!

github-actions bot commented Nov 19, 2025

Uh oh!

github-actions bot commented Nov 19, 2025

Uh oh!

Uh oh!

github-actions bot commented Nov 26, 2025

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants