modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

mcp: decode a Base64-wrapped Mcp-Name before comparing it to the body (#1242)

Browse source 
The 2026-07-28 transport spec lets a client Base64-wrap a name or
resource URI that is not header-safe (`=?base64?...?=`) and requires the
server to decode it before comparing. `validateMcpHeaders` decoded
`Mcp-Param-*` values that way but compared `Mcp-Name` raw, so a
spec-legal encoded name was refused as a header mismatch.

This decodes `Mcp-Name` before comparing, mirroring the existing
`Mcp-Param-*` path, and rejects an invalid Base64 wrapper with a clear
error. Added table cases covering a valid encoded name and an invalid
one (red before, green after).

Fixes #1234

Co-authored-by: Arpan Mondal <arpanmondal@Arpans-MacBook-Pro.local>
Co-authored-by: Guglielmo Colombo <guglielmoc@google.com>
This commit is contained in:
ARPAN MONDAL 2026-09-06 15:36:58 +05:30 • committed by GitHub
commit a5026ea7b7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 26 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
mcp/streamable_headers.go
View file

@ -378,13 +378,18 @@ func validateMcpHeaders(header http.Header, msg jsonrpc.Message, toolLookup func
if nameInHeader == "" {
return fmt.Errorf("missing required Mcp-Name header for method %q", msg.Method)
}
var ok bool
// A name that is not header-safe may be Base64-wrapped by the client
// (=?base64?...?=), so decode before comparing, as with Mcp-Param-*.
decodedName, ok := decodeHeaderValue(nameInHeader)
if !ok {
return errors.New("header mismatch: Mcp-Name header contains invalid Base64 encoding")
}
nameInBody, ok = extractName(msg.Method, msg.Params)
if !ok {
return fmt.Errorf("failed to extract name from parameters for method %q", msg.Method)
}
if nameInHeader != nameInBody {
return fmt.Errorf("header mismatch: Mcp-Name header value '%s' does not match body value '%s'", nameInHeader, nameInBody)
if decodedName != nameInBody {
return fmt.Errorf("header mismatch: Mcp-Name header value '%s' does not match body value '%s'", decodedName, nameInBody)
}
}