davsclaus opened a new pull request, #29752: URL: https://github.com/apache/camel/pull/29752
Fixes https://issues.apache.org/jira/browse/CAMEL-26665 Follow-up to CAMEL-26359 (#29284), which added the `Origin` check on `/mcp` for the Camel Main engine. This adds the optional `Host` check the MCP Java SDK validator also offers. ## Change New option `camel.server.mcp-allowed-hosts`: a comma-separated list of hosts. ```properties camel.server.mcp-allowed-hosts = mcp.example.com, localhost:*, 127.0.0.1:* ``` - **Not set (the default):** the `Host` header is not checked, as today. Nothing changes for existing users, so there is no upgrade-guide entry. - **Set:** a request on `/mcp` (POST, the SSE GET and DELETE) whose `Host` is missing or not in the list gets **HTTP 421** with a JSON-RPC error that has no `id`. This happens in the same handler as the Origin check, before the body is read and before any session is created. It protects a server on a private address against DNS rebinding. - **Matching:** the host is compared ignoring case. `host:*` matches any port and also a `Host` without a port, so `localhost:*` allows `localhost` and `localhost:8080`. An entry without a port matches only a `Host` without a port. IPv6 addresses go in brackets (`[::1]:*`). - **Fail fast:** an entry with a scheme or a path, or `*`, fails the startup with a message saying why, as the origins option does. - **Other engines:** engines that do not take the serving configuration (Spring Boot, Quarkus) log a warning that the option is ignored, as for the allowed origins. Those engines follow in CAMEL-26360, which is in progress by another contributor. **421, not 403:** the ticket said 403. The SDK's `DefaultServerTransportSecurityValidator` answers 421 (Misdirected Request) for a Host that is not allowed, and the transport passes the validator's status on, as it already does for the Origin. The SDK-based transports of CAMEL-26360 will answer 421 too, so keeping the SDK status keeps the engines consistent. ## Implementation - `McpServerHosts` (camel-mcp-server-api, new): parses and normalizes the list, mirroring `McpServerOrigins`. - `McpServerConfiguration.allowedHosts` and a new `McpServerInfo.allowedHosts` record component, with a compatibility constructor for the previous canonical signature. - `VertxMcpStreamableServerTransportProvider`: passes the hosts to the SDK validator's `allowedHosts`, and adds `host` next to each `host:*` entry so a `Host` without a port matches. The `Host` value is read from the request authority, which is `:authority` on HTTP/2. - `HttpServerConfigurationProperties.mcpAllowedHosts` in camel-main, with the regenerated configurer, metadata and `main.adoc`, and their catalog copies. - Docs: the "Origins and binding" section of the mcp-server page, and its catalog copy. ## Tests - `VertxMcpHostTest` (new, next to `VertxMcpOriginTest`), 12 tests: - not set = no check; - an allowed host is served, any other host gets 421 for POST, the SSE GET and DELETE, and the rejected request does not call the tool; - a rebound host name is refused; - case-insensitive matching, `:*` with and without a port, exact ports; - the Origin check still comes first; - a missing `Host` is refused: Vert.x itself answers 400 on HTTP/1.1, and the check answers 421 on HTTP/1.0. - `McpServerHostsTest` (new), plus new cases in `McpServerBridgeTest` and `McpServerMainPropertiesTest` (the property from `camel.server.*`, and fail-fast on an entry with a scheme). - The full camel-mcp-server suite (123 tests) and the camel-mcp-server-api tests pass locally. _Claude Code on behalf of davsclaus_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
