modelcontextprotocol/java-sdk
Watch
1
0
Fork
You've already forked java-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Polish gh-771

Browse source 
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
This commit is contained in:
Daniel Garnier-Moiroux 2026-02-12 10:21:36 +01:00
commit b57b1269d0
5 changed files with 49 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

9
mcp-core/src/main/java/io/modelcontextprotocol/server/transport/DefaultServerTransportSecurityValidator.java
View file

@ -21,13 +21,10 @@ import io.modelcontextprotocol.util.Assert;
* @see ServerTransportSecurityValidator
* @see ServerTransportSecurityException
*/
public class DefaultServerTransportSecurityValidator implements ServerTransportSecurityValidator {
public final class DefaultServerTransportSecurityValidator implements ServerTransportSecurityValidator {
private static final String ORIGIN_HEADER = "Origin";
private static final ServerTransportSecurityException INVALID_ORIGIN = new ServerTransportSecurityException(403,
"Invalid Origin header");
private final List<String> allowedOrigins;
/**
@ -35,7 +32,7 @@ public class DefaultServerTransportSecurityValidator implements ServerTransportS
* @param allowedOrigins List of allowed origin patterns. Supports exact matches
* (e.g., "http://example.com:8080") and wildcard ports (e.g., "http://example.com:*")
*/
public DefaultServerTransportSecurityValidator(List<String> allowedOrigins) {
private DefaultServerTransportSecurityValidator(List<String> allowedOrigins) {
Assert.notNull(allowedOrigins, "allowedOrigins must not be null");
this.allowedOrigins = allowedOrigins;
}
@ -79,7 +76,7 @@ public class DefaultServerTransportSecurityValidator implements ServerTransportS
}
throw INVALID_ORIGIN;
throw new ServerTransportSecurityException(403, "Invalid Origin header");
}
/**

40
mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletRequestUtils.java Normal file
View file

@ -0,0 +1,40 @@
/*
* Copyright 2026-2026 the original author or authors.
*/
package io.modelcontextprotocol.server.transport;
import java.util.Collections;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import jakarta.servlet.http.HttpServletRequest;
/**
* Utility methods for working with {@link HttpServletRequest}. For internal use only.
*
* @author Daniel Garnier-Moiroux
*/
final class HttpServletRequestUtils {
private HttpServletRequestUtils() {
}
/**
* Extracts all headers from the HTTP request into a map.
* @param request The HTTP servlet request
* @return A map of header names to their values
*/
static Map<String, List<String>> extractHeaders(HttpServletRequest request) {
Map<String, List<String>> headers = new HashMap<>();
Enumeration<String> names = request.getHeaderNames();
while (names.hasMoreElements()) {
String name = names.nextElement();
headers.put(name, Collections.list(request.getHeaders(name)));
}
return headers;
}
}

22
mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java
View file

@ -8,9 +8,6 @@ import java.io.BufferedReader;
import java.io.IOException;
import java.io.PrintWriter;
import java.time.Duration;
import java.util.Collections;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.UUID;
@ -258,7 +255,7 @@ public class HttpServletSseServerTransportProvider extends HttpServlet implement
}
try {
Map<String, List<String>> headers = extractHeaders(request);
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
this.securityValidator.validateHeaders(headers);
}
catch (ServerTransportSecurityException e) {
@ -332,7 +329,7 @@ public class HttpServletSseServerTransportProvider extends HttpServlet implement
}
try {
Map<String, List<String>> headers = extractHeaders(request);
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
this.securityValidator.validateHeaders(headers);
}
catch (ServerTransportSecurityException e) {
@ -440,21 +437,6 @@ public class HttpServletSseServerTransportProvider extends HttpServlet implement
}
}
/**
* Extracts all headers from the HTTP servlet request into a map.
* @param request The HTTP servlet request
* @return A map of header names to their values
*/
private Map<String, List<String>> extractHeaders(HttpServletRequest request) {
Map<String, List<String>> headers = new HashMap<>();
Enumeration<String> names = request.getHeaderNames();
while (names.hasMoreElements()) {
String name = names.nextElement();
headers.put(name, Collections.list(request.getHeaders(name)));
}
return headers;
}
/**
* Cleans up resources when the servlet is being destroyed.
* <p>

20
mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStatelessServerTransport.java
View file

@ -7,9 +7,6 @@ package io.modelcontextprotocol.server.transport;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.PrintWriter;
import java.util.Collections;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
@ -137,7 +134,7 @@ public class HttpServletStatelessServerTransport extends HttpServlet implements
}
try {
Map<String, List<String>> headers = extractHeaders(request);
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
this.securityValidator.validateHeaders(headers);
}
catch (ServerTransportSecurityException e) {
@ -232,21 +229,6 @@ public class HttpServletStatelessServerTransport extends HttpServlet implements
writer.flush();
}
/**
* Extracts all headers from the HTTP servlet request into a map.
* @param request The HTTP servlet request
* @return A map of header names to their values
*/
private Map<String, List<String>> extractHeaders(HttpServletRequest request) {
Map<String, List<String>> headers = new HashMap<>();
Enumeration<String> names = request.getHeaderNames();
while (names.hasMoreElements()) {
String name = names.nextElement();
headers.put(name, Collections.list(request.getHeaders(name)));
}
return headers;
}
/**
* Cleans up resources when the servlet is being destroyed.
* <p>

24
mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java
View file

@ -9,9 +9,6 @@ import java.io.IOException;
import java.io.PrintWriter;
import java.time.Duration;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
@ -262,7 +259,7 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
}
try {
Map<String, List<String>> headers = extractHeaders(request);
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
this.securityValidator.validateHeaders(headers);
}
catch (ServerTransportSecurityException e) {
@ -398,7 +395,7 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
}
try {
Map<String, List<String>> headers = extractHeaders(request);
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
this.securityValidator.validateHeaders(headers);
}
catch (ServerTransportSecurityException e) {
@ -570,7 +567,7 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
}
try {
Map<String, List<String>> headers = extractHeaders(request);
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
this.securityValidator.validateHeaders(headers);
}
catch (ServerTransportSecurityException e) {
@ -628,21 +625,6 @@ public class HttpServletStreamableServerTransportProvider extends HttpServlet
return;
}
/**
* Extracts all headers from the HTTP servlet request into a map.
* @param request The HTTP servlet request
* @return A map of header names to their values
*/
private Map<String, List<String>> extractHeaders(HttpServletRequest request) {
Map<String, List<String>> headers = new HashMap<>();
Enumeration<String> names = request.getHeaderNames();
while (names.hasMoreElements()) {
String name = names.nextElement();
headers.put(name, Collections.list(request.getHeaders(name)));
}
return headers;
}
/**
* Sends an SSE event to a client with a specific ID.
* @param writer The writer to send the event through