Claus Ibsen created CAMEL-26359:
-----------------------------------
Summary: camel-mcp-server - validate the Origin header on /mcp, as
the MCP Streamable HTTP transport requires
Key: CAMEL-26359
URL: https://issues.apache.org/jira/browse/CAMEL-26359
Project: Camel
Issue Type: Improvement
Components: camel-mcp-server
Reporter: Claus Ibsen
Fix For: 4.24.0
The MCP Streamable HTTP transport says a server must validate the {{Origin}}
header of incoming requests, and that a local server should bind to localhost.
The Camel Main engine does not look at {{Origin}} today. The platform-http CORS
handler only adds response headers, and without a configured origin list it
reflects any origin, so it does not reject anything.
h3. Proposal, for the Camel Main engine
* A request without an {{Origin}} header is served as today. MCP clients call
from a process, not a browser, and send none.
* A request with an {{Origin}} header is served only when the origin is
allowed. Anything else gets 403 with a JSON-RPC error, and no tool, resource or
prompt route is called.
* {{camel.server.mcp-allowed-origins}}: a comma-separated list of allowed
origins.
* The default, when the option is not set, allows loopback origins only
({{localhost}}, {{127.0.0.1}}, {{::1}}, any port), so browser-based tools on
the developer's machine keep working.
* The check covers every method on {{/mcp}}, including the SSE {{GET}} and
{{DELETE}}, and is independent of the CORS configuration.
* Stdio mode has no HTTP and is not affected.
* The docs gain a short section on binding and origins. Since the default
changes for browser callers from other origins, this needs an upgrade-guide
entry.
h3. Tests
No {{Origin}}, a loopback origin, a configured origin, a rejected origin, and
the SSE channel.
The Camel Main and Camel JBang engine is the reference implementation and gets
the complete feature; the Spring Boot and Quarkus engines follow in a separate
parity ticket, which does not block this one.
_Filed by Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
