davsclaus commented on code in PR #29284:
URL: https://github.com/apache/camel/pull/29284#discussion_r4490092240
##########
components/camel-ai/camel-mcp-server-api/src/main/java/org/apache/camel/component/mcp/server/McpServerBridge.java:
##########
@@ -210,6 +217,27 @@ private boolean hasServerMetadataConfiguration() {
|| (configuration.getServerIcons() != null &&
!configuration.getServerIcons().isEmpty());
}
+ /**
+ * Splits the comma-separated allowed origins into a list, trimming each
entry and dropping a trailing {@code /}.
+ * Returns {@code null} when not set, so the engine applies its default
(loopback origins only).
+ */
+ static List<String> parseAllowedOrigins(String allowedOrigins) {
Review Comment:
Thanks, addressed in 1048a0359550 along the lines you suggested:
- New `McpServerOrigins` helper (camel-mcp-server-api). Each entry is
normalized the way a browser sends `Origin`: scheme and host in lower case, the
default port dropped (`:80` for http, `:443` for https), and a trailing `/`
removed. The Vert.x transport normalizes the incoming `Origin` header the same
way before the SDK validator compares them. `https://App.Example.com` and
`https://app.example.com:443` now match `https://app.example.com`.
- An entry that can never match fails the startup with a message saying why:
`*`, an entry with a path, query or userinfo, one without a scheme, a wildcard
in the host (`https://*.example.com`), or a bad port. `*` is deliberately not
supported as "allow all", since that would turn the check off. The message says
to list the origins and that clients with no `Origin` header are always served.
- Tests: `McpServerOriginsTest` (normalization and refused entries), HTTP
tests in `VertxMcpOriginTest` (case and default port, on the configured list
and the loopback default), a Camel Main test where
`camel.server.mcp-allowed-origins=*` fails the start, and a bridge test.
- Docs: `mcp-server.adoc` (option row and the "Origins and binding" section,
including the DEBUG logger for refused requests), the camel-main option
description (regenerated with the catalog copies) and the 4.24 upgrade guide
entry.
_Claude Code on behalf of davsclaus_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
