gnodet-bot commented on code in PR #29930: URL: https://github.com/apache/camel/pull/29930#discussion_r4573369375
########## docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc: ########## @@ -255,8 +255,22 @@ By default only loopback origins are allowed (`localhost`, `127.0.0.1` and `[::1 client served from another origin must now be listed in the new `camel.server.mcp-allowed-origins` option, for example `+camel.server.mcp-allowed-origins = https://app.example.com, http://localhost:*+`. The list replaces the loopback default. Scheme and host are compared ignoring case and a default port may be left out; `+*+` and other entries that are -not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected, and neither are the Spring Boot and -Quarkus engines. +not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected. + +Spring Boot applications using `camel-mcp-server-starter` with Spring AI's +Streamable HTTP transport now check the `Origin` header in the same way. By +default, only loopback origins are allowed. Configure Review Comment: **Low:** `"in the same way"` is vague — the paragraph above specifies concrete matching rules (scheme/host compared case-insensitively, `*` as port wildcard, fail-startup on invalid entries). Consider replacing with a brief active-voice restatement to avoid forcing cross-reference: ```suggestion Streamable HTTP transport checks the `Origin` header on every request (`POST`, `GET`, `DELETE`). By ``` ########## docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc: ########## @@ -255,8 +255,22 @@ By default only loopback origins are allowed (`localhost`, `127.0.0.1` and `[::1 client served from another origin must now be listed in the new `camel.server.mcp-allowed-origins` option, for example `+camel.server.mcp-allowed-origins = https://app.example.com, http://localhost:*+`. The list replaces the loopback default. Scheme and host are compared ignoring case and a default port may be left out; `+*+` and other entries that are -not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected, and neither are the Spring Boot and -Quarkus engines. +not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected. + +Spring Boot applications using `camel-mcp-server-starter` with Spring AI's +Streamable HTTP transport now check the `Origin` header in the same way. By +default, only loopback origins are allowed. Configure +`camel.mcp-server.allowed-origins` to allow browser clients from other origins, +for example: + +[source,properties] +---- +camel.mcp-server.allowed-origins = https://app.example.com, http://localhost:* +---- + +The configured list replaces the loopback defaults. An application-provided +Spring AI transport provider must configure its own Origin validator. This Review Comment: **Low (nit):** `"loopback defaults"` (plural) — the paragraph above uses `"the loopback default"` (singular). Minor inconsistency; suggest aligning: ```suggestion The configured list replaces the loopback default. An application-provided ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
