580f2a09beThis PR introduces protection against cross-origin requests by installing `http.CrossOriginProtection`. By default, the zero value is used which does not contain any trusted origins or bypass patterns. The protection can be customized by providing a custom `http.CrossOriginProtection` in `mcp.StreamableHTTPOptions`. Currently, the deny handler set on the protection is ignored. This default has an MCPGODEBUG option (`disableoriginverification`) to disable the default protection. It will be available until `v1.6.0` of the SDK. We also increase the Go version required by the SDK to 1.25, since this is the version that introduced `http.CrossOriginProtection`. This is in line with the SDK's policy of supporting two newest Go versions (1.26 was released in February 2026). Additionally, we start validating if the `Content-Type` header for `POST` requests is set to `application/json` to avoid accepting CORS-safelisted requests.
17 lines
850 B
Go
17 lines
850 B
Go
// Copyright 2025 The Go MCP SDK Authors. All rights reserved.
|
|
// Use of this source code is governed by an MIT-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
//go:generate -command weave go run golang.org/x/example/internal/cmd/weave@latest
|
|
//go:generate weave -o ../../docs/README.md ./README.src.md
|
|
//go:generate weave -o ../../docs/protocol.md ./protocol.src.md
|
|
//go:generate weave -o ../../docs/client.md ./client.src.md
|
|
//go:generate weave -o ../../docs/server.md ./server.src.md
|
|
//go:generate weave -o ../../docs/troubleshooting.md ./troubleshooting.src.md
|
|
//go:generate weave -o ../../docs/rough_edges.md ./rough_edges.src.md
|
|
//go:generate weave -o ../../docs/mcpgodebug.md ./mcpgodebug.src.md
|
|
|
|
// The doc package generates the documentation at /doc, via go:generate.
|
|
//
|
|
// Tests in this package are used for examples.
|
|
package docs
|