ramu11 commented on code in PR #29930: URL: https://github.com/apache/camel/pull/29930#discussion_r4573388617
########## docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc: ########## @@ -255,8 +255,22 @@ By default only loopback origins are allowed (`localhost`, `127.0.0.1` and `[::1 client served from another origin must now be listed in the new `camel.server.mcp-allowed-origins` option, for example `+camel.server.mcp-allowed-origins = https://app.example.com, http://localhost:*+`. The list replaces the loopback default. Scheme and host are compared ignoring case and a default port may be left out; `+*+` and other entries that are -not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected, and neither are the Spring Boot and -Quarkus engines. +not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected. + +Spring Boot applications using `camel-mcp-server-starter` with Spring AI's +Streamable HTTP transport now check the `Origin` header in the same way. By +default, only loopback origins are allowed. Configure +`camel.mcp-server.allowed-origins` to allow browser clients from other origins, +for example: + +[source,properties] +---- +camel.mcp-server.allowed-origins = https://app.example.com, http://localhost:* +---- + +The configured list replaces the loopback defaults. An application-provided +Spring AI transport provider must configure its own Origin validator. This Review Comment: Addressed ########## docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc: ########## @@ -255,8 +255,22 @@ By default only loopback origins are allowed (`localhost`, `127.0.0.1` and `[::1 client served from another origin must now be listed in the new `camel.server.mcp-allowed-origins` option, for example `+camel.server.mcp-allowed-origins = https://app.example.com, http://localhost:*+`. The list replaces the loopback default. Scheme and host are compared ignoring case and a default port may be left out; `+*+` and other entries that are -not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected, and neither are the Spring Boot and -Quarkus engines. +not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected. + +Spring Boot applications using `camel-mcp-server-starter` with Spring AI's +Streamable HTTP transport now check the `Origin` header in the same way. By +default, only loopback origins are allowed. Configure Review Comment: Addressed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
