Claus Ibsen created CAMEL-26665:
-----------------------------------
Summary: camel-mcp-server - optional allow-list for the Host
header on /mcp (Camel Main engine)
Key: CAMEL-26665
URL: https://issues.apache.org/jira/browse/CAMEL-26665
Project: Camel
Issue Type: Improvement
Components: camel-mcp-server
Reporter: Claus Ibsen
Fix For: 4.24.0
Follow-up to CAMEL-26359, which added the {{camel.server.mcp-allowed-origins}}
check on {{/mcp}} for the Camel Main engine (PR
https://github.com/apache/camel/pull/29284).
The MCP Java SDK's server transport validator can check the {{Host}} header as
well as {{Origin}} (its {{allowedHosts}} list). The Camel Main engine checks
only {{Origin}} today.
*Proposal*, for the Camel Main engine:
* a new option {{camel.server.mcp-allowed-hosts}}: a comma-separated list of
host names, with the same matching as the origins option (exact, or ending in
{{:*}} for any port);
* not set (the default): the {{Host}} header is not checked, as today;
* set: a request on {{/mcp}} (POST, the SSE GET and DELETE) whose {{Host}} is
not in the list gets 403, before the body is read and before any session is
created, the same way as a refused {{Origin}};
* tests next to {{VertxMcpOriginTest}}, docs in the "Origins and binding"
section of the component page.
Spring Boot and Quarkus follow in CAMEL-26360.
_Claude Code on behalf of Claus Ibsen (davsclaus)_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
