feat: introduce ServerHttpHeaderValidator replacing ServerTransportSecurityValidator

Same feature set as ServerTransportSecurityValidator but uses a lazy
"header accessor" function to read header values instead of extracting
all headers into a map. Matches more closely what modern frameworks and
JDK APIs do.

Fixes #870

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/DefaultServerTransportSecurityValidator.java

@@ -7,6 +7,7 @@ package io.modelcontextprotocol.server.transport;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 
 import io.modelcontextprotocol.util.Assert;
 
@@ -22,7 +23,8 @@ import io.modelcontextprotocol.util.Assert;
  * @see ServerTransportSecurityValidator
  * @see ServerTransportSecurityException
  */
-public final class DefaultServerTransportSecurityValidator implements ServerTransportSecurityValidator {
+public final class DefaultServerTransportSecurityValidator
+		implements ServerTransportSecurityValidator, ServerHttpHeaderValidator {
 
 	private static final String ORIGIN_HEADER = "Origin";
 
@@ -47,27 +49,24 @@ public final class DefaultServerTransportSecurityValidator implements ServerTran
 	}
 
 	@Override
+	@Deprecated
 	public void validateHeaders(Map<String, List<String>> headers) throws ServerTransportSecurityException {
-		boolean missingHost = true;
+		validate(new MapHeaderAccessor(headers));
-		for (Map.Entry<String, List<String>> entry : headers.entrySet()) {
+	}
-			if (ORIGIN_HEADER.equalsIgnoreCase(entry.getKey())) {
+
-				List<String> values = entry.getValue();
+	@Override
-				if (values == null || values.isEmpty()) {
+	public void validate(HeaderAccessor headerAccessor) throws ServerTransportSecurityException {
-					throw new ServerTransportSecurityException(403, "Invalid Origin header");
+		List<String> originValues = headerAccessor.getHeader(ORIGIN_HEADER);
-				}
+		if (originValues != null && !originValues.isEmpty()) {
-				validateOrigin(values.get(0));
+			validateOrigin(originValues.get(0));
-			}
-			else if (HOST_HEADER.equalsIgnoreCase(entry.getKey())) {
-				missingHost = false;
-				List<String> values = entry.getValue();
-				if (values == null || values.isEmpty()) {
-					throw new ServerTransportSecurityException(421, "Invalid Host header");
-				}
-				validateHost(values.get(0));
-			}
 		}
-		if (!allowedHosts.isEmpty() && missingHost) {
+
-			throw new ServerTransportSecurityException(421, "Invalid Host header");
+		if (!allowedHosts.isEmpty()) {
+			List<String> hostValues = headerAccessor.getHeader(HOST_HEADER);
+			if (hostValues == null || hostValues.isEmpty()) {
+				throw new ServerTransportSecurityException(421, "Invalid Host header");
+			}
+			validateHost(hostValues.get(0));
 		}
 	}
 
@@ -139,6 +138,37 @@ public final class DefaultServerTransportSecurityValidator implements ServerTran
 		return new Builder();
 	}
 
+	/**
+	 * {@link HeaderAccessor} view over a {@code Map<String, List<String>>}, used to
+	 * bridge the deprecated {@link #validateHeaders(Map)} to
+	 * {@link #validate(HeaderAccessor)}.
+	 */
+	private static final class MapHeaderAccessor implements HeaderAccessor {
+
+		private final Map<String, List<String>> headers;
+
+		private MapHeaderAccessor(Map<String, List<String>> headers) {
+			this.headers = headers;
+		}
+
+		@Override
+		public List<String> getHeader(String name) {
+			return headers.entrySet()
+				.stream()
+				.filter(entry -> entry.getKey().equalsIgnoreCase(name))
+				.map(Map.Entry::getValue)
+				.filter(Objects::nonNull)
+				.findFirst()
+				.orElse(List.of());
+		}
+
+		@Override
+		public List<String> getHeaderNames() {
+			return List.copyOf(headers.keySet());
+		}
+
+	}
+
 	/**
 	 * Builder for creating instances of {@link DefaultServerTransportSecurityValidator}.
 	 */

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HeaderAccessor.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright 2026-2026 the original author or authors.
+ */
+
+package io.modelcontextprotocol.server.transport;
+
+import java.util.List;
+
+/**
+ * Abstraction for accessing HTTP headers from an incoming request. Implementations should
+ * provide case-insensitive header name lookups (e.g., when backed by
+ * {@code HttpServletRequest}).
+ *
+ * @author Neeraj Bhatt
+ * @since 2.1.0
+ * @see ServerHttpHeaderValidator
+ */
+public interface HeaderAccessor {
+
+	/**
+	 * Returns the values of the specified header, or an empty list if the header is not
+	 * present.
+	 * @param name the header name (case-insensitive)
+	 * @return the list of header values, never {@code null}
+	 */
+	List<String> getHeader(String name);
+
+	/**
+	 * Returns all header names present in the request.
+	 * @return the list of header names, never {@code null}
+	 */
+	List<String> getHeaderNames();
+
+}

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletHeaderAccessor.java

@@ -0,0 +1,41 @@
+/*
+ * Copyright 2026-2026 the original author or authors.
+ */
+
+package io.modelcontextprotocol.server.transport;
+
+import java.util.Collections;
+import java.util.List;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+/**
+ * {@link HeaderAccessor} implementation backed by an {@link HttpServletRequest}. Header
+ * name lookups are case-insensitive as per the Servlet specification.
+ *
+ * <p>
+ * For internal use only.
+ *
+ * @author Neeraj Bhatt
+ * @since 2.1.0
+ * @see HeaderAccessor
+ */
+final class HttpServletHeaderAccessor implements HeaderAccessor {
+
+	private final HttpServletRequest request;
+
+	HttpServletHeaderAccessor(HttpServletRequest request) {
+		this.request = request;
+	}
+
+	@Override
+	public List<String> getHeader(String name) {
+		return Collections.list(this.request.getHeaders(name));
+	}
+
+	@Override
+	public List<String> getHeaderNames() {
+		return Collections.list(this.request.getHeaderNames());
+	}
+
+}

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletRequestUtils.java

@@ -8,11 +8,6 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
-import java.util.Collections;
-import java.util.Enumeration;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
 
 import jakarta.servlet.http.HttpServletRequest;
 
@@ -26,21 +21,6 @@ final class HttpServletRequestUtils {
 	private HttpServletRequestUtils() {
 	}
 
-	/**
-	 * Extracts all headers from the HTTP request into a map.
-	 * @param request The HTTP servlet request
-	 * @return A map of header names to their values
-	 */
-	static Map<String, List<String>> extractHeaders(HttpServletRequest request) {
-		Map<String, List<String>> headers = new HashMap<>();
-		Enumeration<String> names = request.getHeaderNames();
-		while (names.hasMoreElements()) {
-			String name = names.nextElement();
-			headers.put(name, Collections.list(request.getHeaders(name)));
-		}
-		return headers;
-	}
-
 	/**
 	 * Reads the request body, decoded using the request's character encoding (or UTF-8 if
 	 * not specified), while bounding the number of bytes read.

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java

@@ -161,7 +161,7 @@ public class HttpServletSseServerTransportProvider extends HttpServlet implement
 	/**
 	 * Security validator for validating HTTP requests.
 	 */
-	private final ServerTransportSecurityValidator securityValidator;
+	private final ServerHttpHeaderValidator httpHeaderValidator;
 
 	/**
 	 * Creates a new HttpServletSseServerTransportProvider instance with a custom SSE
@@ -174,20 +174,20 @@ public class HttpServletSseServerTransportProvider extends HttpServlet implement
 	 * @param keepAliveInterval The interval for keep-alive pings, or null to disable
 	 * keep-alive functionality
 	 * @param contextExtractor The extractor for transport context from the request.
-	 * @param securityValidator The security validator for validating HTTP requests.
+	 * @param httpHeaderValidator The HTTP header validator for validating HTTP requests.
 	 * @param requestMaxSize The maximum size, in bytes, of a single request body. Must be
 	 * positive.
 	 */
 	private HttpServletSseServerTransportProvider(McpJsonMapper jsonMapper, String baseUrl, String messageEndpoint,
 			String sseEndpoint, Duration keepAliveInterval,
 			McpTransportContextExtractor<HttpServletRequest> contextExtractor,
-			ServerTransportSecurityValidator securityValidator, int requestMaxSize) {
+			ServerHttpHeaderValidator httpHeaderValidator, int requestMaxSize) {
 
 		Assert.notNull(jsonMapper, "JsonMapper must not be null");
 		Assert.notNull(messageEndpoint, "messageEndpoint must not be null");
 		Assert.notNull(sseEndpoint, "sseEndpoint must not be null");
 		Assert.notNull(contextExtractor, "Context extractor must not be null");
-		Assert.notNull(securityValidator, "Security validator must not be null");
+		Assert.notNull(httpHeaderValidator, "HTTP header validator must not be null");
 		Assert.isTrue(requestMaxSize > 0, "requestMaxSize must be positive");
 
 		this.jsonMapper = jsonMapper;
@@ -195,7 +195,7 @@ public class HttpServletSseServerTransportProvider extends HttpServlet implement
 		this.messageEndpoint = messageEndpoint;
 		this.sseEndpoint = sseEndpoint;
 		this.contextExtractor = contextExtractor;
-		this.securityValidator = securityValidator;
+		this.httpHeaderValidator = httpHeaderValidator;
 		this.requestMaxSize = requestMaxSize;
 
 		if (keepAliveInterval != null) {
@@ -293,8 +293,7 @@ public class HttpServletSseServerTransportProvider extends HttpServlet implement
 		}
 
 		try {
-			Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
+			this.httpHeaderValidator.validate(new HttpServletHeaderAccessor(request));
-			this.securityValidator.validateHeaders(headers);
 		}
 		catch (ServerTransportSecurityException e) {
 			response.sendError(e.getStatusCode(), e.getMessage());
@@ -371,8 +370,7 @@ public class HttpServletSseServerTransportProvider extends HttpServlet implement
 		}
 
 		try {
-			Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
+			this.httpHeaderValidator.validate(new HttpServletHeaderAccessor(request));
-			this.securityValidator.validateHeaders(headers);
 		}
 		catch (ServerTransportSecurityException e) {
 			response.sendError(e.getStatusCode(), e.getMessage());
@@ -619,7 +617,7 @@ public class HttpServletSseServerTransportProvider extends HttpServlet implement
 
 		private Duration keepAliveInterval;
 
-		private ServerTransportSecurityValidator securityValidator = ServerTransportSecurityValidator.NOOP;
+		private ServerHttpHeaderValidator httpHeaderValidator = ServerHttpHeaderValidator.NOOP;
 
 		private int requestMaxSize = DEFAULT_REQUEST_MAX_SIZE;
 
@@ -702,10 +700,25 @@ public class HttpServletSseServerTransportProvider extends HttpServlet implement
 		 * @param securityValidator The security validator to use. Must not be null.
 		 * @return This builder instance
 		 * @throws IllegalArgumentException if securityValidator is null
+		 * @deprecated Use {@link #httpHeaderValidator(ServerHttpHeaderValidator)}
+		 * instead.
 		 */
+		@Deprecated
 		public Builder securityValidator(ServerTransportSecurityValidator securityValidator) {
 			Assert.notNull(securityValidator, "Security validator must not be null");
-			this.securityValidator = securityValidator;
+			this.httpHeaderValidator = ServerTransportSecurityValidator.toHttpHeaderValidator(securityValidator);
+			return this;
+		}
+
+		/**
+		 * Sets the HTTP header validator for validating HTTP requests.
+		 * @param httpHeaderValidator The HTTP header validator to use. Must not be null.
+		 * @return This builder instance
+		 * @throws IllegalArgumentException if httpHeaderValidator is null
+		 */
+		public Builder httpHeaderValidator(ServerHttpHeaderValidator httpHeaderValidator) {
+			Assert.notNull(httpHeaderValidator, "HTTP header validator must not be null");
+			this.httpHeaderValidator = httpHeaderValidator;
 			return this;
 		}
 
@@ -734,7 +747,7 @@ public class HttpServletSseServerTransportProvider extends HttpServlet implement
 			}
 			return new HttpServletSseServerTransportProvider(
 					jsonMapper == null ? McpJsonDefaults.getMapper() : jsonMapper, baseUrl, messageEndpoint,
-					sseEndpoint, keepAliveInterval, contextExtractor, securityValidator, requestMaxSize);
+					sseEndpoint, keepAliveInterval, contextExtractor, httpHeaderValidator, requestMaxSize);
 		}
 
 	}

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStatelessServerTransport.java

@@ -7,7 +7,6 @@ package io.modelcontextprotocol.server.transport;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.util.List;
-import java.util.Map;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -68,7 +67,7 @@ public class HttpServletStatelessServerTransport extends HttpServlet implements
 	/**
 	 * Security validator for validating HTTP requests.
 	 */
-	private final ServerTransportSecurityValidator securityValidator;
+	private final ServerHttpHeaderValidator httpHeaderValidator;
 
 	/**
 	 * Maximum size, in bytes, of a single request body accepted by this transport.
@@ -82,24 +81,24 @@ public class HttpServletStatelessServerTransport extends HttpServlet implements
 	 * @param mcpEndpoint The endpoint URI where clients should send their JSON-RPC
 	 * messages.
 	 * @param contextExtractor The extractor for transport context from the request.
-	 * @param securityValidator The security validator for validating HTTP requests.
+	 * @param httpHeaderValidator The HTTP header validator for validating HTTP requests.
 	 * @param requestMaxSize The maximum size, in bytes, of a single request body. Must be
 	 * positive.
 	 * @throws IllegalArgumentException if any parameter is null
 	 */
 	private HttpServletStatelessServerTransport(McpJsonMapper jsonMapper, String mcpEndpoint,
 			McpTransportContextExtractor<HttpServletRequest> contextExtractor,
-			ServerTransportSecurityValidator securityValidator, int requestMaxSize) {
+			ServerHttpHeaderValidator httpHeaderValidator, int requestMaxSize) {
 		Assert.notNull(jsonMapper, "jsonMapper must not be null");
 		Assert.notNull(mcpEndpoint, "mcpEndpoint must not be null");
 		Assert.notNull(contextExtractor, "contextExtractor must not be null");
-		Assert.notNull(securityValidator, "Security validator must not be null");
+		Assert.notNull(httpHeaderValidator, "HTTP header validator must not be null");
 		Assert.isTrue(requestMaxSize > 0, "requestMaxSize must be positive");
 
 		this.jsonMapper = jsonMapper;
 		this.mcpEndpoint = mcpEndpoint;
 		this.contextExtractor = contextExtractor;
-		this.securityValidator = securityValidator;
+		this.httpHeaderValidator = httpHeaderValidator;
 		this.requestMaxSize = requestMaxSize;
 	}
 
@@ -162,8 +161,7 @@ public class HttpServletStatelessServerTransport extends HttpServlet implements
 		}
 
 		try {
-			Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
+			this.httpHeaderValidator.validate(new HttpServletHeaderAccessor(request));
-			this.securityValidator.validateHeaders(headers);
 		}
 		catch (ServerTransportSecurityException e) {
 			response.sendError(e.getStatusCode(), e.getMessage());
@@ -300,7 +298,7 @@ public class HttpServletStatelessServerTransport extends HttpServlet implements
 		private McpTransportContextExtractor<HttpServletRequest> contextExtractor = (
 				serverRequest) -> McpTransportContext.EMPTY;
 
-		private ServerTransportSecurityValidator securityValidator = ServerTransportSecurityValidator.NOOP;
+		private ServerHttpHeaderValidator httpHeaderValidator = ServerHttpHeaderValidator.NOOP;
 
 		private int requestMaxSize = DEFAULT_REQUEST_MAX_SIZE;
 
@@ -354,10 +352,25 @@ public class HttpServletStatelessServerTransport extends HttpServlet implements
 		 * @param securityValidator The security validator to use. Must not be null.
 		 * @return this builder instance
 		 * @throws IllegalArgumentException if securityValidator is null
+		 * @deprecated Use {@link #httpHeaderValidator(ServerHttpHeaderValidator)}
+		 * instead.
 		 */
+		@Deprecated
 		public Builder securityValidator(ServerTransportSecurityValidator securityValidator) {
 			Assert.notNull(securityValidator, "Security validator must not be null");
-			this.securityValidator = securityValidator;
+			this.httpHeaderValidator = ServerTransportSecurityValidator.toHttpHeaderValidator(securityValidator);
+			return this;
+		}
+
+		/**
+		 * Sets the HTTP header validator for validating HTTP requests.
+		 * @param httpHeaderValidator The HTTP header validator to use. Must not be null.
+		 * @return this builder instance
+		 * @throws IllegalArgumentException if httpHeaderValidator is null
+		 */
+		public Builder httpHeaderValidator(ServerHttpHeaderValidator httpHeaderValidator) {
+			Assert.notNull(httpHeaderValidator, "HTTP header validator must not be null");
+			this.httpHeaderValidator = httpHeaderValidator;
 			return this;
 		}
 
@@ -384,7 +397,7 @@ public class HttpServletStatelessServerTransport extends HttpServlet implements
 			Assert.notNull(mcpEndpoint, "Message endpoint must be set");
 			return new HttpServletStatelessServerTransport(
 					jsonMapper == null ? McpJsonDefaults.getMapper() : jsonMapper, mcpEndpoint, contextExtractor,
-					securityValidator, requestMaxSize);
+					httpHeaderValidator, requestMaxSize);
 		}
 
 	}

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java

@@ -9,7 +9,6 @@ import java.io.PrintWriter;
 import java.time.Duration;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.locks.ReentrantLock;
 
@@ -131,7 +130,7 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
 	/**
 	 * Security validator for validating HTTP requests.
 	 */
-	private final ServerTransportSecurityValidator securityValidator;
+	private final ServerHttpHeaderValidator httpHeaderValidator;
 
 	/**
 	 * Constructs a new HttpServletStreamableServerTransportProvider instance.
@@ -143,25 +142,25 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
 	 * @param contextExtractor The extractor for transport context from the request.
 	 * @param keepAliveInterval The interval for keep-alive pings. If null, no keep-alive
 	 * will be scheduled.
-	 * @param securityValidator The security validator for validating HTTP requests.
+	 * @param httpHeaderValidator The HTTP header validator for validating HTTP requests.
 	 * @param requestMaxSize The maximum size, in bytes, of a single request body. Must be
 	 * positive.
 	 * @throws IllegalArgumentException if any parameter is null
 	 */
 	private HttpServletStreamableServerTransportProvider(McpJsonMapper jsonMapper, String mcpEndpoint,
 			boolean disallowDelete, McpTransportContextExtractor<HttpServletRequest> contextExtractor,
-			Duration keepAliveInterval, ServerTransportSecurityValidator securityValidator, int requestMaxSize) {
+			Duration keepAliveInterval, ServerHttpHeaderValidator httpHeaderValidator, int requestMaxSize) {
 		Assert.notNull(jsonMapper, "JsonMapper must not be null");
 		Assert.notNull(mcpEndpoint, "MCP endpoint must not be null");
 		Assert.notNull(contextExtractor, "Context extractor must not be null");
-		Assert.notNull(securityValidator, "Security validator must not be null");
+		Assert.notNull(httpHeaderValidator, "HTTP header validator must not be null");
 		Assert.isTrue(requestMaxSize > 0, "requestMaxSize must be positive");
 
 		this.jsonMapper = jsonMapper;
 		this.mcpEndpoint = mcpEndpoint;
 		this.disallowDelete = disallowDelete;
 		this.contextExtractor = contextExtractor;
-		this.securityValidator = securityValidator;
+		this.httpHeaderValidator = httpHeaderValidator;
 		this.requestMaxSize = requestMaxSize;
 
 		if (keepAliveInterval != null) {
@@ -275,8 +274,7 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
 		}
 
 		try {
-			Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
+			this.httpHeaderValidator.validate(new HttpServletHeaderAccessor(request));
-			this.securityValidator.validateHeaders(headers);
 		}
 		catch (ServerTransportSecurityException e) {
 			response.sendError(e.getStatusCode(), e.getMessage());
@@ -415,8 +413,7 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
 		}
 
 		try {
-			Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
+			this.httpHeaderValidator.validate(new HttpServletHeaderAccessor(request));
-			this.securityValidator.validateHeaders(headers);
 		}
 		catch (ServerTransportSecurityException e) {
 			response.sendError(e.getStatusCode(), e.getMessage());
@@ -594,8 +591,7 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
 		}
 
 		try {
-			Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
+			this.httpHeaderValidator.validate(new HttpServletHeaderAccessor(request));
-			this.securityValidator.validateHeaders(headers);
 		}
 		catch (ServerTransportSecurityException e) {
 			response.sendError(e.getStatusCode(), e.getMessage());
@@ -848,7 +844,7 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
 
 		private Duration keepAliveInterval;
 
-		private ServerTransportSecurityValidator securityValidator = ServerTransportSecurityValidator.NOOP;
+		private ServerHttpHeaderValidator httpHeaderValidator = ServerHttpHeaderValidator.NOOP;
 
 		private int requestMaxSize = DEFAULT_REQUEST_MAX_SIZE;
 
@@ -916,10 +912,25 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
 		 * @param securityValidator The security validator to use. Must not be null.
 		 * @return this builder instance
 		 * @throws IllegalArgumentException if securityValidator is null
+		 * @deprecated Use {@link #httpHeaderValidator(ServerHttpHeaderValidator)}
+		 * instead.
 		 */
+		@Deprecated
 		public Builder securityValidator(ServerTransportSecurityValidator securityValidator) {
 			Assert.notNull(securityValidator, "Security validator must not be null");
-			this.securityValidator = securityValidator;
+			this.httpHeaderValidator = ServerTransportSecurityValidator.toHttpHeaderValidator(securityValidator);
+			return this;
+		}
+
+		/**
+		 * Sets the HTTP header validator for validating HTTP requests.
+		 * @param httpHeaderValidator The HTTP header validator to use. Must not be null.
+		 * @return this builder instance
+		 * @throws IllegalArgumentException if httpHeaderValidator is null
+		 */
+		public Builder httpHeaderValidator(ServerHttpHeaderValidator httpHeaderValidator) {
+			Assert.notNull(httpHeaderValidator, "HTTP header validator must not be null");
+			this.httpHeaderValidator = httpHeaderValidator;
 			return this;
 		}
 
@@ -946,7 +957,7 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
 			Assert.notNull(this.mcpEndpoint, "MCP endpoint must be set");
 			return new HttpServletStreamableServerTransportProvider(
 					jsonMapper == null ? McpJsonDefaults.getMapper() : jsonMapper, mcpEndpoint, disallowDelete,
-					contextExtractor, keepAliveInterval, securityValidator, requestMaxSize);
+					contextExtractor, keepAliveInterval, httpHeaderValidator, requestMaxSize);
 		}
 
 	}

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/ServerHttpHeaderValidator.java

@@ -0,0 +1,30 @@
+/*
+ * Copyright 2026-2026 the original author or authors.
+ */
+
+package io.modelcontextprotocol.server.transport;
+
+/**
+ * Validates HTTP request headers in server transports.
+ *
+ * @author Neeraj Bhatt
+ * @see HeaderAccessor
+ * @see ServerTransportSecurityException
+ */
+@FunctionalInterface
+public interface ServerHttpHeaderValidator {
+
+	/**
+	 * A no-op validator that accepts all requests without validation.
+	 */
+	ServerHttpHeaderValidator NOOP = headerAccessor -> {
+	};
+
+	/**
+	 * Validates the HTTP headers from an incoming request.
+	 * @param headerAccessor provides access to request headers
+	 * @throws ServerTransportSecurityException if validation fails
+	 */
+	void validate(HeaderAccessor headerAccessor) throws ServerTransportSecurityException;
+
+}

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/ServerTransportSecurityValidator.java

@@ -6,6 +6,8 @@ package io.modelcontextprotocol.server.transport;
 
 import java.util.List;
 import java.util.Map;
+import java.util.function.Function;
+import java.util.stream.Collectors;
 
 /**
  * Interface for validating HTTP requests in server transports. Implementations can
@@ -13,9 +15,12 @@ import java.util.Map;
  * to the MCP specification.
  *
  * @author Daniel Garnier-Moiroux
- * @see DefaultServerTransportSecurityValidator
+ * @see ServerHttpHeaderValidator
  * @see ServerTransportSecurityException
+ * @deprecated Use {@link ServerHttpHeaderValidator} instead. This interface will be
+ * removed in a future major version.
  */
+@Deprecated
 @FunctionalInterface
 public interface ServerTransportSecurityValidator {
 
@@ -25,6 +30,20 @@ public interface ServerTransportSecurityValidator {
 	ServerTransportSecurityValidator NOOP = headers -> {
 	};
 
+	/**
+	 * Adapts a legacy map-based validator to a header accessor validator.
+	 * @param validator the legacy validator to adapt
+	 * @return a header accessor validator delegating to {@code validator}
+	 */
+	static ServerHttpHeaderValidator toHttpHeaderValidator(ServerTransportSecurityValidator validator) {
+		return accessor -> {
+			var collectedHeaders = accessor.getHeaderNames()
+				.stream()
+				.collect(Collectors.toUnmodifiableMap(Function.identity(), accessor::getHeader));
+			validator.validateHeaders(collectedHeaders);
+		};
+	}
+
 	/**
 	 * Validates the HTTP headers from an incoming request.
 	 * @param headers A map of header names to their values (multi-valued headers

mcp-core/src/test/java/io/modelcontextprotocol/server/transport/DefaultServerTransportSecurityValidatorTests.java

@@ -43,50 +43,50 @@ class DefaultServerTransportSecurityValidatorTests {
 
 		@Test
 		void originHeaderMissing() {
-			assertThatCode(() -> validator.validateHeaders(new HashMap<>())).doesNotThrowAnyException();
+			assertThatCode(() -> validator.validate(emptyAccessor())).doesNotThrowAnyException();
 		}
 
 		@Test
 		void originHeaderListEmpty() {
-			assertThatThrownBy(() -> validator.validateHeaders(Map.of("Origin", List.of()))).isEqualTo(INVALID_ORIGIN);
+			assertThatCode(() -> validator.validate(headerAccessor())).doesNotThrowAnyException();
 		}
 
 		@Test
 		void caseInsensitive() {
-			var headers = Map.of("origin", List.of("http://localhost:8080"));
+			var accessor = headerAccessor("Origin", "http://localhost:8080");
 
-			assertThatCode(() -> validator.validateHeaders(headers)).doesNotThrowAnyException();
+			assertThatCode(() -> validator.validate(accessor)).doesNotThrowAnyException();
 		}
 
 		@Test
 		void exactMatch() {
-			var headers = originHeader("http://localhost:8080");
+			var accessor = originAccessor("http://localhost:8080");
 
-			assertThatCode(() -> validator.validateHeaders(headers)).doesNotThrowAnyException();
+			assertThatCode(() -> validator.validate(accessor)).doesNotThrowAnyException();
 		}
 
 		@Test
 		void differentPort() {
 
-			var headers = originHeader("http://localhost:3000");
+			var accessor = originAccessor("http://localhost:3000");
 
-			assertThatThrownBy(() -> validator.validateHeaders(headers)).isEqualTo(INVALID_ORIGIN);
+			assertThatThrownBy(() -> validator.validate(accessor)).isEqualTo(INVALID_ORIGIN);
 		}
 
 		@Test
 		void differentHost() {
 
-			var headers = originHeader("http://example.com:8080");
+			var accessor = originAccessor("http://example.com:8080");
 
-			assertThatThrownBy(() -> validator.validateHeaders(headers)).isEqualTo(INVALID_ORIGIN);
+			assertThatThrownBy(() -> validator.validate(accessor)).isEqualTo(INVALID_ORIGIN);
 		}
 
 		@Test
 		void differentScheme() {
 
-			var headers = originHeader("https://localhost:8080");
+			var accessor = originAccessor("https://localhost:8080");
 
-			assertThatThrownBy(() -> validator.validateHeaders(headers)).isEqualTo(INVALID_ORIGIN);
+			assertThatThrownBy(() -> validator.validate(accessor)).isEqualTo(INVALID_ORIGIN);
 		}
 
 		@Nested
@@ -99,37 +99,37 @@ class DefaultServerTransportSecurityValidatorTests {
 
 			@Test
 			void anyPortWithWildcard() {
-				var headers = originHeader("http://localhost:3000");
+				var accessor = originAccessor("http://localhost:3000");
 
-				assertThatCode(() -> wildcardValidator.validateHeaders(headers)).doesNotThrowAnyException();
+				assertThatCode(() -> wildcardValidator.validate(accessor)).doesNotThrowAnyException();
 			}
 
 			@Test
 			void noPortWithWildcard() {
-				var headers = originHeader("http://localhost");
+				var accessor = originAccessor("http://localhost");
 
-				assertThatCode(() -> wildcardValidator.validateHeaders(headers)).doesNotThrowAnyException();
+				assertThatCode(() -> wildcardValidator.validate(accessor)).doesNotThrowAnyException();
 			}
 
 			@Test
 			void differentPortWithWildcard() {
-				var headers = originHeader("http://localhost:8080");
+				var accessor = originAccessor("http://localhost:8080");
 
-				assertThatCode(() -> wildcardValidator.validateHeaders(headers)).doesNotThrowAnyException();
+				assertThatCode(() -> wildcardValidator.validate(accessor)).doesNotThrowAnyException();
 			}
 
 			@Test
 			void differentHostWithWildcard() {
-				var headers = originHeader("http://example.com:3000");
+				var accessor = originAccessor("http://example.com:3000");
 
-				assertThatThrownBy(() -> wildcardValidator.validateHeaders(headers)).isEqualTo(INVALID_ORIGIN);
+				assertThatThrownBy(() -> wildcardValidator.validate(accessor)).isEqualTo(INVALID_ORIGIN);
 			}
 
 			@Test
 			void differentSchemeWithWildcard() {
-				var headers = originHeader("https://localhost:3000");
+				var accessor = originAccessor("https://localhost:3000");
 
-				assertThatThrownBy(() -> wildcardValidator.validateHeaders(headers)).isEqualTo(INVALID_ORIGIN);
+				assertThatThrownBy(() -> wildcardValidator.validate(accessor)).isEqualTo(INVALID_ORIGIN);
 			}
 
 		}
@@ -146,23 +146,23 @@ class DefaultServerTransportSecurityValidatorTests {
 
 			@Test
 			void matchingOneOfMultiple() {
-				var headers = originHeader("http://example.com:3000");
+				var accessor = originAccessor("http://example.com:3000");
 
-				assertThatCode(() -> multipleOriginsValidator.validateHeaders(headers)).doesNotThrowAnyException();
+				assertThatCode(() -> multipleOriginsValidator.validate(accessor)).doesNotThrowAnyException();
 			}
 
 			@Test
 			void matchingWildcardInMultiple() {
-				var headers = originHeader("http://myapp.example.com:9999");
+				var accessor = originAccessor("http://myapp.example.com:9999");
 
-				assertThatCode(() -> multipleOriginsValidator.validateHeaders(headers)).doesNotThrowAnyException();
+				assertThatCode(() -> multipleOriginsValidator.validate(accessor)).doesNotThrowAnyException();
 			}
 
 			@Test
 			void notMatchingAny() {
-				var headers = originHeader("http://malicious.example.com:1234");
+				var accessor = originAccessor("http://malicious.example.com:1234");
 
-				assertThatThrownBy(() -> multipleOriginsValidator.validateHeaders(headers)).isEqualTo(INVALID_ORIGIN);
+				assertThatThrownBy(() -> multipleOriginsValidator.validate(accessor)).isEqualTo(INVALID_ORIGIN);
 			}
 
 		}
@@ -176,9 +176,9 @@ class DefaultServerTransportSecurityValidatorTests {
 					.allowedOrigins(List.of("http://localhost:8080", "http://example.com:*"))
 					.build();
 
-				var headers = originHeader("http://example.com:3000");
+				var accessor = originAccessor("http://example.com:3000");
 
-				assertThatCode(() -> validator.validateHeaders(headers)).doesNotThrowAnyException();
+				assertThatCode(() -> validator.validate(accessor)).doesNotThrowAnyException();
 			}
 
 			@Test
@@ -188,11 +188,11 @@ class DefaultServerTransportSecurityValidatorTests {
 					.allowedOrigins(List.of("http://example.com:*", "http://test.com:3000"))
 					.build();
 
-				assertThatCode(() -> validator.validateHeaders(originHeader("http://localhost:8080")))
+				assertThatCode(() -> validator.validate(originAccessor("http://localhost:8080")))
 					.doesNotThrowAnyException();
-				assertThatCode(() -> validator.validateHeaders(originHeader("http://example.com:9999")))
+				assertThatCode(() -> validator.validate(originAccessor("http://example.com:9999")))
 					.doesNotThrowAnyException();
-				assertThatCode(() -> validator.validateHeaders(originHeader("http://test.com:3000")))
+				assertThatCode(() -> validator.validate(originAccessor("http://test.com:3000")))
 					.doesNotThrowAnyException();
 			}
 
@@ -210,45 +210,45 @@ class DefaultServerTransportSecurityValidatorTests {
 
 		@Test
 		void notConfigured() {
-			assertThatCode(() -> validator.validateHeaders(new HashMap<>())).doesNotThrowAnyException();
+			assertThatCode(() -> validator.validate(emptyAccessor())).doesNotThrowAnyException();
 		}
 
 		@Test
 		void missing() {
-			assertThatThrownBy(() -> hostValidator.validateHeaders(new HashMap<>())).isEqualTo(INVALID_HOST);
+			assertThatThrownBy(() -> hostValidator.validate(emptyAccessor())).isEqualTo(INVALID_HOST);
 		}
 
 		@Test
 		void listEmpty() {
-			assertThatThrownBy(() -> hostValidator.validateHeaders(Map.of("Host", List.of()))).isEqualTo(INVALID_HOST);
+			assertThatThrownBy(() -> hostValidator.validate(headerAccessor())).isEqualTo(INVALID_HOST);
 		}
 
 		@Test
 		void caseInsensitive() {
-			var headers = Map.of("host", List.of("localhost:8080"));
+			var accessor = headerAccessor("Host", "localhost:8080");
 
-			assertThatCode(() -> hostValidator.validateHeaders(headers)).doesNotThrowAnyException();
+			assertThatCode(() -> hostValidator.validate(accessor)).doesNotThrowAnyException();
 		}
 
 		@Test
 		void exactMatch() {
-			var headers = hostHeader("localhost:8080");
+			var accessor = hostAccessor("localhost:8080");
 
-			assertThatCode(() -> hostValidator.validateHeaders(headers)).doesNotThrowAnyException();
+			assertThatCode(() -> hostValidator.validate(accessor)).doesNotThrowAnyException();
 		}
 
 		@Test
 		void differentPort() {
-			var headers = hostHeader("localhost:3000");
+			var accessor = hostAccessor("localhost:3000");
 
-			assertThatThrownBy(() -> hostValidator.validateHeaders(headers)).isEqualTo(INVALID_HOST);
+			assertThatThrownBy(() -> hostValidator.validate(accessor)).isEqualTo(INVALID_HOST);
 		}
 
 		@Test
 		void differentHost() {
-			var headers = hostHeader("example.com:8080");
+			var accessor = hostAccessor("example.com:8080");
 
-			assertThatThrownBy(() -> hostValidator.validateHeaders(headers)).isEqualTo(INVALID_HOST);
+			assertThatThrownBy(() -> hostValidator.validate(accessor)).isEqualTo(INVALID_HOST);
 		}
 
 		@Nested
@@ -261,23 +261,23 @@ class DefaultServerTransportSecurityValidatorTests {
 
 			@Test
 			void anyPort() {
-				var headers = hostHeader("localhost:3000");
+				var accessor = hostAccessor("localhost:3000");
 
-				assertThatCode(() -> wildcardHostValidator.validateHeaders(headers)).doesNotThrowAnyException();
+				assertThatCode(() -> wildcardHostValidator.validate(accessor)).doesNotThrowAnyException();
 			}
 
 			@Test
 			void noPort() {
-				var headers = hostHeader("localhost");
+				var accessor = hostAccessor("localhost");
 
-				assertThatCode(() -> wildcardHostValidator.validateHeaders(headers)).doesNotThrowAnyException();
+				assertThatCode(() -> wildcardHostValidator.validate(accessor)).doesNotThrowAnyException();
 			}
 
 			@Test
 			void differentHost() {
-				var headers = hostHeader("example.com:3000");
+				var accessor = hostAccessor("example.com:3000");
 
-				assertThatThrownBy(() -> wildcardHostValidator.validateHeaders(headers)).isEqualTo(INVALID_HOST);
+				assertThatThrownBy(() -> wildcardHostValidator.validate(accessor)).isEqualTo(INVALID_HOST);
 			}
 
 		}
@@ -293,30 +293,30 @@ class DefaultServerTransportSecurityValidatorTests {
 
 			@Test
 			void exactMatch() {
-				var headers = hostHeader("example.com:3000");
+				var accessor = hostAccessor("example.com:3000");
 
-				assertThatCode(() -> multipleHostsValidator.validateHeaders(headers)).doesNotThrowAnyException();
+				assertThatCode(() -> multipleHostsValidator.validate(accessor)).doesNotThrowAnyException();
 			}
 
 			@Test
 			void wildcard() {
-				var headers = hostHeader("myapp.example.com:9999");
+				var accessor = hostAccessor("myapp.example.com:9999");
 
-				assertThatCode(() -> multipleHostsValidator.validateHeaders(headers)).doesNotThrowAnyException();
+				assertThatCode(() -> multipleHostsValidator.validate(accessor)).doesNotThrowAnyException();
 			}
 
 			@Test
 			void differentHost() {
-				var headers = hostHeader("malicious.example.com:3000");
+				var accessor = hostAccessor("malicious.example.com:3000");
 
-				assertThatThrownBy(() -> multipleHostsValidator.validateHeaders(headers)).isEqualTo(INVALID_HOST);
+				assertThatThrownBy(() -> multipleHostsValidator.validate(accessor)).isEqualTo(INVALID_HOST);
 			}
 
 			@Test
 			void differentPort() {
-				var headers = hostHeader("localhost:8080");
+				var accessor = hostAccessor("localhost:8080");
 
-				assertThatThrownBy(() -> multipleHostsValidator.validateHeaders(headers)).isEqualTo(INVALID_HOST);
+				assertThatThrownBy(() -> multipleHostsValidator.validate(accessor)).isEqualTo(INVALID_HOST);
 			}
 
 		}
@@ -330,10 +330,8 @@ class DefaultServerTransportSecurityValidatorTests {
 					.allowedHosts(List.of("localhost:8080", "example.com:*"))
 					.build();
 
-				assertThatCode(() -> validator.validateHeaders(hostHeader("example.com:3000")))
+				assertThatCode(() -> validator.validate(hostAccessor("example.com:3000"))).doesNotThrowAnyException();
-					.doesNotThrowAnyException();
+				assertThatCode(() -> validator.validate(hostAccessor("localhost:8080"))).doesNotThrowAnyException();
-				assertThatCode(() -> validator.validateHeaders(hostHeader("localhost:8080")))
-					.doesNotThrowAnyException();
 			}
 
 			@Test
@@ -343,11 +341,9 @@ class DefaultServerTransportSecurityValidatorTests {
 					.allowedHosts(List.of("example.com:*", "test.com:3000"))
 					.build();
 
-				assertThatCode(() -> validator.validateHeaders(hostHeader("localhost:8080")))
+				assertThatCode(() -> validator.validate(hostAccessor("localhost:8080"))).doesNotThrowAnyException();
-					.doesNotThrowAnyException();
+				assertThatCode(() -> validator.validate(hostAccessor("example.com:9999"))).doesNotThrowAnyException();
-				assertThatCode(() -> validator.validateHeaders(hostHeader("example.com:9999")))
+				assertThatCode(() -> validator.validate(hostAccessor("test.com:3000"))).doesNotThrowAnyException();
-					.doesNotThrowAnyException();
-				assertThatCode(() -> validator.validateHeaders(hostHeader("test.com:3000"))).doesNotThrowAnyException();
 			}
 
 		}
@@ -365,60 +361,195 @@ class DefaultServerTransportSecurityValidatorTests {
 
 		@Test
 		void bothValid() {
-			var header = headers("http://localhost:8080", "localhost:8080");
+			var accessor = combinedAccessor("http://localhost:8080", "localhost:8080");
 
-			assertThatCode(() -> combinedValidator.validateHeaders(header)).doesNotThrowAnyException();
+			assertThatCode(() -> combinedValidator.validate(accessor)).doesNotThrowAnyException();
 		}
 
 		@Test
 		void originValidHostInvalid() {
-			var header = headers("http://localhost:8080", "malicious.example.com:8080");
+			var accessor = combinedAccessor("http://localhost:8080", "malicious.example.com:8080");
 
-			assertThatThrownBy(() -> combinedValidator.validateHeaders(header)).isEqualTo(INVALID_HOST);
+			assertThatThrownBy(() -> combinedValidator.validate(accessor)).isEqualTo(INVALID_HOST);
 		}
 
 		@Test
 		void originInvalidHostValid() {
-			var header = headers("http://malicious.example.com:8080", "localhost:8080");
+			var accessor = combinedAccessor("http://malicious.example.com:8080", "localhost:8080");
 
-			assertThatThrownBy(() -> combinedValidator.validateHeaders(header)).isEqualTo(INVALID_ORIGIN);
+			assertThatThrownBy(() -> combinedValidator.validate(accessor)).isEqualTo(INVALID_ORIGIN);
 		}
 
 		@Test
 		void originMissingHostValid() {
 			// Origin missing is OK (same-origin request)
-			var header = headers(null, "localhost:8080");
+			var accessor = combinedAccessor(null, "localhost:8080");
 
-			assertThatCode(() -> combinedValidator.validateHeaders(header)).doesNotThrowAnyException();
+			assertThatCode(() -> combinedValidator.validate(accessor)).doesNotThrowAnyException();
 		}
 
 		@Test
 		void originValidHostMissing() {
 			// Host missing is NOT OK when allowedHosts is configured
-			var header = headers("http://localhost:8080", null);
+			var accessor = combinedAccessor("http://localhost:8080", null);
 
-			assertThatThrownBy(() -> combinedValidator.validateHeaders(header)).isEqualTo(INVALID_HOST);
+			assertThatThrownBy(() -> combinedValidator.validate(accessor)).isEqualTo(INVALID_HOST);
 		}
 
 	}
 
-	private static Map<String, List<String>> originHeader(String origin) {
+	@Nested
-		return Map.of("Origin", List.of(origin));
+	class DeprecatedMapBasedApi {
+
+		@Test
+		void originValidation() {
+			Map<String, List<String>> headers = new HashMap<>();
+			headers.put("Origin", List.of("http://localhost:8080"));
+
+			assertThatCode(() -> validator.validateHeaders(headers)).doesNotThrowAnyException();
+		}
+
+		@Test
+		void originRejected() {
+			Map<String, List<String>> headers = new HashMap<>();
+			headers.put("Origin", List.of("http://malicious.example.com"));
+
+			assertThatThrownBy(() -> validator.validateHeaders(headers)).isEqualTo(INVALID_ORIGIN);
+		}
+
+		@Test
+		void caseInsensitiveHeaderLookup() {
+			Map<String, List<String>> headers = new HashMap<>();
+			headers.put("origin", List.of("http://localhost:8080"));
+
+			assertThatCode(() -> validator.validateHeaders(headers)).doesNotThrowAnyException();
+		}
+
+		@Test
+		void hostValidation() {
+			DefaultServerTransportSecurityValidator hostValidator = DefaultServerTransportSecurityValidator.builder()
+				.allowedHost("localhost:8080")
+				.build();
+
+			Map<String, List<String>> headers = new HashMap<>();
+			headers.put("Host", List.of("localhost:8080"));
+
+			assertThatCode(() -> hostValidator.validateHeaders(headers)).doesNotThrowAnyException();
+		}
+
+		@Test
+		void hostRejected() {
+			DefaultServerTransportSecurityValidator hostValidator = DefaultServerTransportSecurityValidator.builder()
+				.allowedHost("localhost:8080")
+				.build();
+
+			Map<String, List<String>> headers = new HashMap<>();
+			headers.put("Host", List.of("malicious.com:8080"));
+
+			assertThatThrownBy(() -> hostValidator.validateHeaders(headers)).isEqualTo(INVALID_HOST);
+		}
+
+		@Test
+		void emptyHeaders() {
+			assertThatCode(() -> validator.validateHeaders(new HashMap<>())).doesNotThrowAnyException();
+		}
+
+		@Test
+		void combinedOriginAndHost() {
+			DefaultServerTransportSecurityValidator combinedValidator = DefaultServerTransportSecurityValidator
+				.builder()
+				.allowedOrigin("http://localhost:*")
+				.allowedHost("localhost:*")
+				.build();
+
+			Map<String, List<String>> headers = new HashMap<>();
+			headers.put("Origin", List.of("http://localhost:8080"));
+			headers.put("Host", List.of("localhost:8080"));
+
+			assertThatCode(() -> combinedValidator.validateHeaders(headers)).doesNotThrowAnyException();
+		}
+
 	}
 
-	private static Map<String, List<String>> hostHeader(String host) {
+	@Nested
-		return Map.of("Host", List.of(host));
+	class ValidatorCompatibility {
+
+		@Test
+		void noopAcceptsAll() {
+			assertThatCode(() -> ServerHttpHeaderValidator.NOOP.validate(emptyAccessor())).doesNotThrowAnyException();
+			assertThatCode(() -> ServerTransportSecurityValidator.NOOP.validateHeaders(new HashMap<>()))
+				.doesNotThrowAnyException();
+		}
+
+		@Test
+		void legacyValidatorAdaptsToHeaderAccessor() {
+			ServerTransportSecurityValidator legacyValidator = headers -> {
+				List<String> origins = headers.getOrDefault("Origin", List.of());
+				if (!origins.isEmpty() && origins.get(0).contains("evil")) {
+					throw new ServerTransportSecurityException(403, "Invalid Origin header");
+				}
+			};
+			ServerHttpHeaderValidator headerValidator = ServerTransportSecurityValidator
+				.toHttpHeaderValidator(legacyValidator);
+
+			assertThatCode(() -> headerValidator.validate(originAccessor("http://good.example.com")))
+				.doesNotThrowAnyException();
+
+			assertThatThrownBy(() -> headerValidator.validate(originAccessor("http://evil.example.com")))
+				.isEqualTo(INVALID_ORIGIN);
+		}
+
 	}
 
-	private static Map<String, List<String>> headers(String origin, String host) {
+	private static HeaderAccessor emptyAccessor() {
-		var map = new HashMap<String, List<String>>();
+		return headerAccessor();
+	}
+
+	private static HeaderAccessor headerAccessor(String... namesAndValues) {
+		Map<String, List<String>> headers = new HashMap<>();
+		for (int i = 0; i < namesAndValues.length; i += 2) {
+			headers.put(namesAndValues[i], List.of(namesAndValues[i + 1]));
+		}
+		return new HeaderAccessor() {
+			@Override
+			public List<String> getHeader(String name) {
+				return headers.getOrDefault(name, List.of());
+			}
+
+			@Override
+			public List<String> getHeaderNames() {
+				return List.copyOf(headers.keySet());
+			}
+		};
+	}
+
+	private static HeaderAccessor originAccessor(String origin) {
+		return headerAccessor("Origin", origin);
+	}
+
+	private static HeaderAccessor hostAccessor(String host) {
+		return headerAccessor("Host", host);
+	}
+
+	private static HeaderAccessor combinedAccessor(String origin, String host) {
+		Map<String, List<String>> headers = new HashMap<>();
 		if (origin != null) {
-			map.put("Origin", List.of(origin));
+			headers.put("Origin", List.of(origin));
 		}
 		if (host != null) {
-			map.put("Host", List.of(host));
+			headers.put("Host", List.of(host));
 		}
-		return map;
+		return new HeaderAccessor() {
+			@Override
+			public List<String> getHeader(String name) {
+				return headers.getOrDefault(name, List.of());
+			}
+
+			@Override
+			public List<String> getHeaderNames() {
+				return List.copyOf(headers.keySet());
+			}
+		};
 	}
 
 }

mcp-test/src/test/java/io/modelcontextprotocol/server/transport/ServerTransportSecurityIntegrationTests.java

@@ -209,7 +209,7 @@ class ServerTransportSecurityIntegrationTests {
 		public Sse() {
 			transport = HttpServletSseServerTransportProvider.builder()
 				.messageEndpoint("/mcp/message")
-				.securityValidator(DefaultServerTransportSecurityValidator.builder()
+				.httpHeaderValidator(DefaultServerTransportSecurityValidator.builder()
 					.allowedOrigin("http://localhost:*")
 					.allowedHost("localhost:*")
 					.build())
@@ -242,7 +242,7 @@ class ServerTransportSecurityIntegrationTests {
 
 		public StreamableHttp() {
 			transport = HttpServletStreamableServerTransportProvider.builder()
-				.securityValidator(DefaultServerTransportSecurityValidator.builder()
+				.httpHeaderValidator(DefaultServerTransportSecurityValidator.builder()
 					.allowedOrigin("http://localhost:*")
 					.allowedHost("localhost:*")
 					.build())
@@ -276,7 +276,7 @@ class ServerTransportSecurityIntegrationTests {
 
 		public Stateless() {
 			transport = HttpServletStatelessServerTransport.builder()
-				.securityValidator(DefaultServerTransportSecurityValidator.builder()
+				.httpHeaderValidator(DefaultServerTransportSecurityValidator.builder()
 					.allowedOrigin("http://localhost:*")
 					.allowedHost("localhost:*")
 					.build())