mcp: remove default cross origin protection (#906)

Fixes #902
2026-04-24 11:35:22 +02:00 · 2026-04-24 11:35:22 +02:00 · 41e1f941bb
commit 41e1f941bb
parent 35f1b07e48
1 changed files with 41 additions and 118 deletions
--- a/mcp/streamable_test.go
+++ b/mcp/streamable_test.go
@ -2587,10 +2587,10 @@ func TestStreamableOriginProtection(t *testing.T) {
 		wantStatusCode int
 	}{
 		{
-			name:           "default protection with Origin header",
+			name:           "no protection with Origin header",
 			protection:     nil,
 			requestOrigin:  "https://example.com",
-			wantStatusCode: http.StatusForbidden,
+			wantStatusCode: http.StatusOK,
 		},
 		{
 			name: "custom protection with trusted origin and same Origin",