fix(http): require auth and bind loopback for HTTP transport (RG-4626)

[lucadruda]

Summary

Fixes RG-4626 (CWE-306 Missing Authentication + CWE-346/CWE-350 DNS rebinding; CVSS 7.4, High). Reported privately to security@docker.com.

In --transport=http mode the server was a confused deputy:

• The listener bound all interfaces (app.listen(port) with no host) → reachable by any TCP peer.
• POST /mcp had no authentication and no Host/Origin validation.
• Every tool call was dispatched under the operator's process-wide HUB_PAT_TOKEN, including write tools (createRepository, updateRepositoryInfo).

So an uncredentialed caller — directly over the network, or via DNS rebinding from a website the operator visited — could enumerate private repos and create/modify repositories under the operator's Docker Hub identity.

Changes

Hardened the HTTP transport to match the accepted upstream pattern (docker/mcp-gateway, GHSA-46gc-mwh4-cc5r). stdio transport is unchanged.

• Loopback by default — binds 127.0.0.1; expose deliberately with --host=0.0.0.0 (logs a warning).
• Auth required, fail-closed — refuses to start HTTP unless MCP_AUTH_TOKEN is set (clients send Authorization: Bearer <token>) or --allow-unauthenticated is explicitly passed. Token comparison is constant-time (crypto.timingSafeEqual over SHA-256 digests).
• DNS-rebinding / CSRF guard — rejects disallowed Host headers (allowlist: loopback + --host + --allowed-hosts) and any browser Origin not in --allowed-origins. Non-browser MCP clients (no Origin, loopback Host) are unaffected.
• Fatal startup errors now print synchronously to stderr (the async logger was truncated by process.exit, hiding the fail-closed reason).
• New config: MCP_AUTH_TOKEN env, --host, --allowed-hosts, --allowed-origins, --allow-unauthenticated. Documented in the README ("Securing the HTTP transport").

Tests

Added src/server.test.ts (Node built-in test runner, compiled via tsconfig.test.json — no esbuild/tsx dependency so it runs under the repo's ignore-scripts CI) and wired npm test into the Lint workflow. Coverage:

• fails closed without a token / opt-out
• 401 on missing and wrong bearer token
• 403 on spoofed Host (DNS rebinding) and disallowed browser Origin
• 200 on an authenticated loopback request
• --allow-unauthenticated serves without a token
• explicitly allowed Origin is honored

Local: build, lint, format:check, test (8/8) all green.

Follow-up

Per the ticket's coordinated-disclosure note: once merged, publish a GHSA/CVE with the security team.

🤖 Generated with Claude Code

[lucadruda]

Addressed the CodeQL findings in c84d09e:

• Polynomial ReDoS (src/server.ts, Authorization parsing) — replaced the /^Bearer\s+(.+)$/i regex with linear indexOf/slice parsing (parseBearerToken), so an attacker-controlled Authorization header can no longer trigger catastrophic backtracking.
• Log injection (rejected Origin/Host) — the header values are now passed through sanitizeForLog, which strips control characters (incl. CR/LF) before they reach the logger, preventing forged/split log entries.

Behaviour is unchanged for well-formed requests; the test suite still passes 8/8. CodeQL should clear alerts 46–48 on the next scan.

[lucadruda]

Follow-up in 5392a36: the ReDoS alert (46) cleared, but the log-injection alerts re-fired (49/50) because CodeQL didn't recognize the Unicode-range strip as a barrier. sanitizeForLog now leads with a newline-stripping replace(/\n|\r/g, '') — the same pattern already used on the request body in this file and accepted by CodeQL — and keeps the control-character strip as defense in depth. build/lint/format/test still green (8/8).