modelcontextprotocol/java-sdk
Watch
1
0
Fork
You've already forked java-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: introduce ServerHttpHeaderValidator replacing ServerTransportSecurityValidator

Browse source 
Same feature set as ServerTransportSecurityValidator but uses a lazy
"header accessor" function to read header values instead of extracting
all headers into a map. Matches more closely what modern frameworks and
JDK APIs do.

Fixes #870

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
This commit is contained in:
Neeraj Bhatt 2026-09-07 14:21:21 +02:00 • committed by Daniel Garnier-Moiroux
commit 5be2fa0688
1 changed files with 470 additions and 168 deletions
Download patch file Download diff file Expand all files Collapse all files

6
mcp-test/src/test/java/io/modelcontextprotocol/server/transport/ServerTransportSecurityIntegrationTests.java
View file

@ -209,7 +209,7 @@ class ServerTransportSecurityIntegrationTests {
public Sse() {
transport = HttpServletSseServerTransportProvider.builder()
.messageEndpoint("/mcp/message")
.securityValidator(DefaultServerTransportSecurityValidator.builder()
.httpHeaderValidator(DefaultServerTransportSecurityValidator.builder()
.allowedOrigin("http://localhost:*")
.allowedHost("localhost:*")
.build())
@ -242,7 +242,7 @@ class ServerTransportSecurityIntegrationTests {
public StreamableHttp() {
transport = HttpServletStreamableServerTransportProvider.builder()
.securityValidator(DefaultServerTransportSecurityValidator.builder()
.httpHeaderValidator(DefaultServerTransportSecurityValidator.builder()
.allowedOrigin("http://localhost:*")
.allowedHost("localhost:*")
.build())
@ -276,7 +276,7 @@ class ServerTransportSecurityIntegrationTests {
public Stateless() {
transport = HttpServletStatelessServerTransport.builder()
.securityValidator(DefaultServerTransportSecurityValidator.builder()
.httpHeaderValidator(DefaultServerTransportSecurityValidator.builder()
.allowedOrigin("http://localhost:*")
.allowedHost("localhost:*")
.build())