Croway commented on code in PR #29284:
URL: https://github.com/apache/camel/pull/29284#discussion_r4486431361
##########
components/camel-ai/camel-mcp-server-api/src/main/java/org/apache/camel/component/mcp/server/McpServerBridge.java:
##########
@@ -210,6 +217,27 @@ private boolean hasServerMetadataConfiguration() {
|| (configuration.getServerIcons() != null &&
!configuration.getServerIcons().isEmpty());
}
+ /**
+ * Splits the comma-separated allowed origins into a list, trimming each
entry and dropping a trailing {@code /}.
+ * Returns {@code null} when not set, so the engine applies its default
(loopback origins only).
+ */
+ static List<String> parseAllowedOrigins(String allowedOrigins) {
Review Comment:
**Low-medium: entries are compared as exact strings, so common ways of
writing an origin match nothing, with no warning**
The SDK validator compares each entry with `String.equals` (or as a prefix
for `:*`), and `parseAllowedOrigins` only trims and drops a trailing `/`.
Reproduced on this PR with `VertxMcpServerEngine` on a `MainHttpServer`,
sending a `POST` `initialize` with an `Origin` header:
| allowed origins | `Origin` sent | status |
|---|---|---|
| `*` | `http://localhost:6274` | 403 |
| `*` | `https://app.example.com` | 403 |
| `https://App.Example.com` | `https://app.example.com` | 403 |
| `https://app.example.com:443` | `https://app.example.com` | 403 |
| `https://app.example.com` | `https://app.example.com` | 200 |
Many users will write `*`, as they do for CORS. Since the list replaces the
loopback default, `*` also locks out `localhost`. Nothing at startup says that
an entry can never match, and the 403s are logged at DEBUG only, so the
operator just sees browser clients fail.
Suggestion: when parsing, lower-case the scheme and host and drop a default
port (`:80` for http, `:443` for https), since browsers send the origin in that
form. Reject an entry that is `*`, has a path or has no scheme, or at least
WARN about it at startup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
