fix: add null-origin consent compatibility flag

[enthouan]

Description

Adds an explicit opt-in compatibility flag for OAuth 2.1 consent flows where a browser or MCP client sends Origin: null on POST /consent. The bypass is limited to that exact method/path/header shape and leaves normal origin validation in place for all other requests.

Context

Origin validation was added in #804, which is useful hardening, but it can also reject legitimate OAuth consent submissions from some browser/MCP-client flows when Chrome sends Origin: null after the OAuth redirect chain. The README currently documents a reverse-proxy workaround for /consent, but that is proxy-specific and awkward for deployments behind Traefik, Caddy, managed ingress, or other setups where conditional header rewriting is not straightforward.

In practice, affected deployments have to either pin to an older image from before the origin-validation change or add custom reverse-proxy rules. This PR provides a narrow image-level alternative: pass one env var to allow only the known POST /consent null-origin compatibility case, without disabling origin validation globally.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Testing

• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have tested this change manually

Test commands run:

• uv run pytest tests/core/test_well_known_cache_control_middleware.py
• uv run ruff check core/server.py tests/core/test_well_known_cache_control_middleware.py

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• I have enabled "Allow edits from maintainers" for this pull request

Additional Notes

The new WORKSPACE_MCP_ALLOW_NULL_ORIGIN_CONSENT flag defaults to disabled. When enabled, it allows only literal Origin: null on POST /consent; /mcp, /token, /.well-known/*, GET /consent, and real disallowed origins remain rejected by OriginValidationMiddleware.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds an environment-gated exception allowing Origin: null only for POST /consent, with middleware tests covering rejection and scope restrictions. README documents the variable and reverse-proxy configuration.

Changes

Null-origin consent compatibility

Layer / File(s)	Summary
Origin validation compatibility path core/server.py	Adds an environment variable constant and permits Origin: null only for enabled POST /consent requests.
Compatibility coverage and documentation tests/core/test_well_known_cache_control_middleware.py, README.md	Tests default rejection, enabled consent handling, and restrictions for other methods, routes, and origins; README documents the configuration.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• taylorwilsdon/google_workspace_mcp#804: Both changes update origin validation for OAuth-related requests.

Suggested reviewers: taylorwilsdon, github-actions[bot], andyroyle, 123andy

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title concisely matches the main change: an opt-in flag for null-origin consent compatibility.
Description check	✅ Passed	The description includes the required sections and gives clear change, testing, checklist, and notes details.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[taylorwilsdon]

Very interesting, I've adjusted my nginx settings but that's not a bad approach. Will do a little refac but will get this merged, thanks!

[enthouan]

@taylorwilsdon Yay! Let me know if I can help in any way to get that merged in. Excited that I'll be able to switch back to the latest Docker image tag soon!