Cover
Photo: StockSnap (CC0)
What you are probably seeing
Your MCP server logs show requests claiming to be from 127.0.0.1 that actually originate from external IPs, indicating the browser is being tricked into sending local traffic to an attacker-controlled host.
You notice that when testing local endpoints, some responses come back with mismatched Host headers, meaning the browser is redirecting what it thinks is a local request to a remote server under the attacker’s control.
Why it happens
Browsers enforce the same-origin policy on localhost to protect local services, but attackers use DNS rebinding to assign dynamic DNS records that flip between a public IP and 127.0.0.1, tricking the browser into thinking the local and remote origins match.
Because the browser validates the Host header against the current DNS lookup, it sends sensitive local data to the public IP when the record flips back, effectively bypassing the localhost restriction and exposing the developer’s local server to the internet.
What changed recently
Step by step
1. Configure your MCP server to reject any request where the Host header does not exactly match ‘localhost’ or ‘127.0.0.1’.
2. Set strict CORS policies on your local server to prevent cross-origin read access to sensitive endpoints.
3. Use a local firewall to block all inbound connections to your development ports except from your own machine.
4. Monitor your server logs for requests with mismatched Host or Origin headers and flag them for immediate review.
5. Test your security by using a DNS rebinding tool locally to confirm your server correctly rejects malicious requests.
Ways to go further
Affiliate links: CHEAPUNO may earn a commission if you buy through them, at no extra cost to you.
Other problems readers raise
Is relying on a single cloud provider too risky for backups?
How to spot fake listings and fake reviews on booking platforms
How to secure physical recovery keys for encrypted backups
Does your backup support Linux for cross-OS freelance files?