From 1f5f7e16a3af23dd43ec0a5c972d7aa8e8429024 Mon Sep 17 00:00:00 2001
From: Edouard Courty <edouard.courty2@gmail.com>
Date: Mon, 23 Feb 2026 22:42:54 +0100
Subject: [PATCH] chore(http): create constant for session id header (#246)

---
 .../Transport/StreamableHttpTransport.php     | 23 ++++++++++++++-----
 .../Transport/StreamableHttpTransportTest.php |  4 ++--
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/src/Server/Transport/StreamableHttpTransport.php b/src/Server/Transport/StreamableHttpTransport.php
index 9f557f3..3c9b2f6 100644
--- a/src/Server/Transport/StreamableHttpTransport.php
+++ b/src/Server/Transport/StreamableHttpTransport.php
@@ -30,6 +30,17 @@ use Symfony\Component\Uid\Uuid;
  */
 class StreamableHttpTransport extends BaseTransport
 {
+    private const SESSION_HEADER = 'Mcp-Session-Id';
+
+    private const ALLOWED_HEADER = [
+        'Accept',
+        'Authorization',
+        'Content-Type',
+        'Last-Event-ID',
+        'Mcp-Protocol-Version',
+        self::SESSION_HEADER,
+    ];
+
     private ResponseFactoryInterface $responseFactory;
     private StreamFactoryInterface $streamFactory;
 
@@ -62,8 +73,8 @@ class StreamableHttpTransport extends BaseTransport
         $this->corsHeaders = array_merge([
             'Access-Control-Allow-Origin' => '*',
             'Access-Control-Allow-Methods' => 'GET, POST, DELETE, OPTIONS',
-            'Access-Control-Allow-Headers' => 'Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, Authorization, Accept',
-            'Access-Control-Expose-Headers' => 'Mcp-Session-Id',
+            'Access-Control-Allow-Headers' => implode(',', self::ALLOWED_HEADER),
+            'Access-Control-Expose-Headers' => self::SESSION_HEADER,
         ], $corsHeaders);
 
         foreach ($middleware as $m) {
@@ -120,7 +131,7 @@ class StreamableHttpTransport extends BaseTransport
     protected function handleDeleteRequest(): ResponseInterface
     {
         if (!$this->sessionId) {
-            return $this->createErrorResponse(Error::forInvalidRequest('Mcp-Session-Id header is required.'), 400);
+            return $this->createErrorResponse(Error::forInvalidRequest(self::SESSION_HEADER.' header is required.'), 400);
         }
 
         $this->handleSessionEnd($this->sessionId);
@@ -144,7 +155,7 @@ class StreamableHttpTransport extends BaseTransport
             ->withBody($this->streamFactory->createStream($responseBody));
 
         if ($this->sessionId) {
-            $response = $response->withHeader('Mcp-Session-Id', $this->sessionId->toRfc4122());
+            $response = $response->withHeader(self::SESSION_HEADER, $this->sessionId->toRfc4122());
         }
 
         return $response;
@@ -211,7 +222,7 @@ class StreamableHttpTransport extends BaseTransport
             ->withBody($stream);
 
         if ($this->sessionId) {
-            $response = $response->withHeader('Mcp-Session-Id', $this->sessionId->toRfc4122());
+            $response = $response->withHeader(self::SESSION_HEADER, $this->sessionId->toRfc4122());
         }
 
         return $response;
@@ -276,7 +287,7 @@ class StreamableHttpTransport extends BaseTransport
     private function handleRequest(ServerRequestInterface $request): ResponseInterface
     {
         $this->request = $request;
-        $sessionIdString = $request->getHeaderLine('Mcp-Session-Id');
+        $sessionIdString = $request->getHeaderLine(self::SESSION_HEADER);
         $this->sessionId = $sessionIdString ? Uuid::fromString($sessionIdString) : null;
 
         return match ($request->getMethod()) {
diff --git a/tests/Unit/Server/Transport/StreamableHttpTransportTest.php b/tests/Unit/Server/Transport/StreamableHttpTransportTest.php
index 51af627..7d9cd48 100644
--- a/tests/Unit/Server/Transport/StreamableHttpTransportTest.php
+++ b/tests/Unit/Server/Transport/StreamableHttpTransportTest.php
@@ -80,7 +80,7 @@ final class StreamableHttpTransportTest extends TestCase
         $this->assertSame('*', $response->getHeaderLine('Access-Control-Allow-Origin'));
         $this->assertSame('GET, POST, DELETE, OPTIONS', $response->getHeaderLine('Access-Control-Allow-Methods'));
         $this->assertSame(
-            'Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, Authorization, Accept',
+            'Accept,Authorization,Content-Type,Last-Event-ID,Mcp-Protocol-Version,Mcp-Session-Id',
             $response->getHeaderLine('Access-Control-Allow-Headers')
         );
         $this->assertSame('Mcp-Session-Id', $response->getHeaderLine('Access-Control-Expose-Headers'));
@@ -120,7 +120,7 @@ final class StreamableHttpTransportTest extends TestCase
         $this->assertSame('https://another.com', $response->getHeaderLine('Access-Control-Allow-Origin'));
         $this->assertSame('GET, POST, DELETE, OPTIONS', $response->getHeaderLine('Access-Control-Allow-Methods'));
         $this->assertSame(
-            'Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, Authorization, Accept',
+            'Accept,Authorization,Content-Type,Last-Event-ID,Mcp-Protocol-Version,Mcp-Session-Id',
             $response->getHeaderLine('Access-Control-Allow-Headers')
         );
         $this->assertSame('Mcp-Session-Id', $response->getHeaderLine('Access-Control-Expose-Headers'));