From 6dd0b1ee4d9ff5e2043cfab7f6391ef4e8ff54b0 Mon Sep 17 00:00:00 2001
From: Achintha Isuru <achinthaisuru444@gmail.com>
Date: Sun, 15 Jun 2025 21:47:53 -0400
Subject: [PATCH 1/2] Update readme file to include a tip to allow
 `mcp-session-id` in CORS when

---
 README.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/README.md b/README.md
index c9e27c27..241056e5 100644
--- a/README.md
+++ b/README.md
@@ -307,6 +307,21 @@ app.delete('/mcp', handleSessionRequest);
 app.listen(3000);
 ```
 
+> [!TIP]
+> When using this in a remote environment, make sure to allow the header parameter `mcp-session-id` in CORS. Otherwise, it may result in a `Bad Request: No valid session ID provided` error. 
+> 
+> For example, in Node.js you can configure it like this:
+> 
+> ```ts
+> app.use(
+>   cors({
+>     origin: '*',
+>     exposedHeaders: ['mcp-session-id'],
+>     allowedHeaders: ['Content-Type', 'mcp-session-id'],
+>   })
+> );
+> ```
+
 #### Without Session Management (Stateless)
 
 For simpler use cases where session management isn't needed:

From 5f96ae4d8954daf656a9b69a73b249f748cfc75d Mon Sep 17 00:00:00 2001
From: Achintha Isuru <achinthaisuru444@gmail.com>
Date: Wed, 25 Jun 2025 11:34:44 -0400
Subject: [PATCH 2/2] update PR#633 to address the comment about improving the
 example

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index abf57afb..de297dc9 100644
--- a/README.md
+++ b/README.md
@@ -508,7 +508,7 @@ app.listen(3000);
 > ```ts
 > app.use(
 >   cors({
->     origin: '*',
+>     origin: ['https://your-remote-domain.com, https://your-other-remote-domain.com'],
 >     exposedHeaders: ['mcp-session-id'],
 >     allowedHeaders: ['Content-Type', 'mcp-session-id'],
 >   })