Security Model
Overview
Section titled “Overview”The MCP Bridge implements defense-in-depth security across all three layers.
Content Security Policy (CSP)
Section titled “Content Security Policy (CSP)”Every HTML response includes a strict CSP header:
Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src wss://your-domain.comCSP directives are auto-generated from resource metadata, with default-src 'none' as the baseline.
Session Authentication
Section titled “Session Authentication”- Session creation: A crypto-secure token is generated using
crypto.getRandomValues() - Token delivery: Sent to the client during the WebSocket handshake
- Validation: Every subsequent message must include the session token
- Expiration: Sessions expire after inactivity (configurable)
Platform Auth
Section titled “Platform Auth”Telegram (HMAC-SHA256)
Section titled “Telegram (HMAC-SHA256)”initData signature = HMAC-SHA256(data_check_string, secret_key)secret_key = HMAC-SHA256(bot_token, "WebAppData")The adapter validates every request’s initData before creating a session.
LINE (OAuth)
Section titled “LINE (OAuth)”Access tokens will be validated against LINE’s token verification API once the LINE platform adapter is complete.
Path Traversal Protection
Section titled “Path Traversal Protection”All ui:// resource paths are normalized before resolution:
../and.segments are resolved lexically- Paths are resolved relative to the app base directory
- Resolved paths must remain within the configured asset directory
Target Origin Validation
Section titled “Target Origin Validation”WebSocket messages include strict origin checking. The bridge only accepts messages from the configured resourceBaseUrl origin.