Skip to content

Commit 9ae9736

Browse files
KehrlannKehrlann
committed
Polish gh-771
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
1 parent 5e186a9 commit 9ae9736

5 files changed

Lines changed: 49 additions & 66 deletions

File tree

‎mcp-core/src/main/java/io/modelcontextprotocol/server/transport/DefaultServerTransportSecurityValidator.java‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,21 +21,18 @@
2121
* @see ServerTransportSecurityValidator
2222
* @see ServerTransportSecurityException
2323
*/
24-
public class DefaultServerTransportSecurityValidator implements ServerTransportSecurityValidator {
24+
public final class DefaultServerTransportSecurityValidator implements ServerTransportSecurityValidator {
2525

2626
private static final String ORIGIN_HEADER = "Origin";
2727

28-
private static final ServerTransportSecurityException INVALID_ORIGIN = new ServerTransportSecurityException(403,
29-
"Invalid Origin header");
30-
3128
private final List<String> allowedOrigins;
3229

3330
/**
3431
* Creates a new validator with the specified allowed origins.
3532
* @param allowedOrigins List of allowed origin patterns. Supports exact matches
3633
* (e.g., "http://example.com:8080") and wildcard ports (e.g., "http://example.com:*")
3734
*/
38-
public DefaultServerTransportSecurityValidator(List<String> allowedOrigins) {
35+
private DefaultServerTransportSecurityValidator(List<String> allowedOrigins) {
3936
Assert.notNull(allowedOrigins, "allowedOrigins must not be null");
4037
this.allowedOrigins = allowedOrigins;
4138
}
@@ -79,7 +76,7 @@ else if (allowed.endsWith(":*")) {
7976

8077
}
8178

82-
throw INVALID_ORIGIN;
79+
throw new ServerTransportSecurityException(403, "Invalid Origin header");
8380
}
8481

8582
/**

‎mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletRequestUtils.java‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/*
2+
* Copyright 2026-2026 the original author or authors.
3+
*/
4+
5+
package io.modelcontextprotocol.server.transport;
6+
7+
import java.util.Collections;
8+
import java.util.Enumeration;
9+
import java.util.HashMap;
10+
import java.util.List;
11+
import java.util.Map;
12+
13+
import jakarta.servlet.http.HttpServletRequest;
14+
15+
/**
16+
* Utility methods for working with {@link HttpServletRequest}. For internal use only.
17+
*
18+
* @author Daniel Garnier-Moiroux
19+
*/
20+
final class HttpServletRequestUtils {
21+
22+
private HttpServletRequestUtils() {
23+
}
24+
25+
/**
26+
* Extracts all headers from the HTTP request into a map.
27+
* @param request The HTTP servlet request
28+
* @return A map of header names to their values
29+
*/
30+
static Map<String, List<String>> extractHeaders(HttpServletRequest request) {
31+
Map<String, List<String>> headers = new HashMap<>();
32+
Enumeration<String> names = request.getHeaderNames();
33+
while (names.hasMoreElements()) {
34+
String name = names.nextElement();
35+
headers.put(name, Collections.list(request.getHeaders(name)));
36+
}
37+
return headers;
38+
}
39+
40+
}

‎mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java‎

Lines changed: 2 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@
88
import java.io.IOException;
99
import java.io.PrintWriter;
1010
import java.time.Duration;
11-
import java.util.Collections;
12-
import java.util.Enumeration;
13-
import java.util.HashMap;
1411
import java.util.List;
1512
import java.util.Map;
1613
import java.util.UUID;
@@ -258,7 +255,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
258255
}
259256

260257
try {
261-
Map<String, List<String>> headers = extractHeaders(request);
258+
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
262259
this.securityValidator.validateHeaders(headers);
263260
}
264261
catch (ServerTransportSecurityException e) {
@@ -332,7 +329,7 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
332329
}
333330

334331
try {
335-
Map<String, List<String>> headers = extractHeaders(request);
332+
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
336333
this.securityValidator.validateHeaders(headers);
337334
}
338335
catch (ServerTransportSecurityException e) {
@@ -440,21 +437,6 @@ private void sendEvent(PrintWriter writer, String eventType, String data) throws
440437
}
441438
}
442439

443-
/**
444-
* Extracts all headers from the HTTP servlet request into a map.
445-
* @param request The HTTP servlet request
446-
* @return A map of header names to their values
447-
*/
448-
private Map<String, List<String>> extractHeaders(HttpServletRequest request) {
449-
Map<String, List<String>> headers = new HashMap<>();
450-
Enumeration<String> names = request.getHeaderNames();
451-
while (names.hasMoreElements()) {
452-
String name = names.nextElement();
453-
headers.put(name, Collections.list(request.getHeaders(name)));
454-
}
455-
return headers;
456-
}
457-
458440
/**
459441
* Cleans up resources when the servlet is being destroyed.
460442
* <p>

‎mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStatelessServerTransport.java‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,6 @@
77
import java.io.BufferedReader;
88
import java.io.IOException;
99
import java.io.PrintWriter;
10-
import java.util.Collections;
11-
import java.util.Enumeration;
12-
import java.util.HashMap;
1310
import java.util.List;
1411
import java.util.Map;
1512

@@ -137,7 +134,7 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
137134
}
138135

139136
try {
140-
Map<String, List<String>> headers = extractHeaders(request);
137+
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
141138
this.securityValidator.validateHeaders(headers);
142139
}
143140
catch (ServerTransportSecurityException e) {
@@ -232,21 +229,6 @@ private void responseError(HttpServletResponse response, int httpCode, McpError
232229
writer.flush();
233230
}
234231

235-
/**
236-
* Extracts all headers from the HTTP servlet request into a map.
237-
* @param request The HTTP servlet request
238-
* @return A map of header names to their values
239-
*/
240-
private Map<String, List<String>> extractHeaders(HttpServletRequest request) {
241-
Map<String, List<String>> headers = new HashMap<>();
242-
Enumeration<String> names = request.getHeaderNames();
243-
while (names.hasMoreElements()) {
244-
String name = names.nextElement();
245-
headers.put(name, Collections.list(request.getHeaders(name)));
246-
}
247-
return headers;
248-
}
249-
250232
/**
251233
* Cleans up resources when the servlet is being destroyed.
252234
* <p>

‎mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java‎

Lines changed: 3 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,6 @@
99
import java.io.PrintWriter;
1010
import java.time.Duration;
1111
import java.util.ArrayList;
12-
import java.util.Collections;
13-
import java.util.Enumeration;
14-
import java.util.HashMap;
1512
import java.util.List;
1613
import java.util.Map;
1714
import java.util.concurrent.ConcurrentHashMap;
@@ -262,7 +259,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
262259
}
263260

264261
try {
265-
Map<String, List<String>> headers = extractHeaders(request);
262+
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
266263
this.securityValidator.validateHeaders(headers);
267264
}
268265
catch (ServerTransportSecurityException e) {
@@ -398,7 +395,7 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
398395
}
399396

400397
try {
401-
Map<String, List<String>> headers = extractHeaders(request);
398+
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
402399
this.securityValidator.validateHeaders(headers);
403400
}
404401
catch (ServerTransportSecurityException e) {
@@ -570,7 +567,7 @@ protected void doDelete(HttpServletRequest request, HttpServletResponse response
570567
}
571568

572569
try {
573-
Map<String, List<String>> headers = extractHeaders(request);
570+
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
574571
this.securityValidator.validateHeaders(headers);
575572
}
576573
catch (ServerTransportSecurityException e) {
@@ -628,21 +625,6 @@ public void responseError(HttpServletResponse response, int httpCode, McpError m
628625
return;
629626
}
630627

631-
/**
632-
* Extracts all headers from the HTTP servlet request into a map.
633-
* @param request The HTTP servlet request
634-
* @return A map of header names to their values
635-
*/
636-
private Map<String, List<String>> extractHeaders(HttpServletRequest request) {
637-
Map<String, List<String>> headers = new HashMap<>();
638-
Enumeration<String> names = request.getHeaderNames();
639-
while (names.hasMoreElements()) {
640-
String name = names.nextElement();
641-
headers.put(name, Collections.list(request.getHeaders(name)));
642-
}
643-
return headers;
644-
}
645-
646628
/**
647629
* Sends an SSE event to a client with a specific ID.
648630
* @param writer The writer to send the event through

0 commit comments

Comments
 (0)