[
https://issues.apache.org/jira/browse/CAMEL-26665?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26665 started by Claus Ibsen.
-------------------------------------------
> camel-mcp-server - optional allow-list for the Host header on /mcp (Camel
> Main engine)
> --------------------------------------------------------------------------------------
>
> Key: CAMEL-26665
> URL: https://issues.apache.org/jira/browse/CAMEL-26665
> Project: Camel
> Issue Type: Improvement
> Components: camel-mcp-server
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Minor
> Fix For: 4.24.0
>
>
> Follow-up to CAMEL-26359, which added the
> {{camel.server.mcp-allowed-origins}} check on {{/mcp}} for the Camel Main
> engine (PR https://github.com/apache/camel/pull/29284).
> The MCP Java SDK's server transport validator can check the {{Host}} header
> as well as {{Origin}} (its {{allowedHosts}} list). The Camel Main engine
> checks only {{Origin}} today.
> *Proposal*, for the Camel Main engine:
> * a new option {{camel.server.mcp-allowed-hosts}}: a comma-separated list of
> host names, with the same matching as the origins option (exact, or ending in
> {{:*}} for any port);
> * not set (the default): the {{Host}} header is not checked, as today;
> * set: a request on {{/mcp}} (POST, the SSE GET and DELETE) whose {{Host}} is
> not in the list gets 403, before the body is read and before any session is
> created, the same way as a refused {{Origin}};
> * tests next to {{VertxMcpOriginTest}}, docs in the "Origins and binding"
> section of the component page.
> Spring Boot and Quarkus follow in CAMEL-26360.
> _Claude Code on behalf of Claus Ibsen (davsclaus)_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
