[ramu11]

Description

Updates the Camel 4.24 upgrade guide to document Origin validation for Spring Boot applications using camel-mcp-server-starter with Spring AI's Streamable HTTP transport.

The update explains:

• By default, only loopback origins are allowed.
• Configure camel.mcp-server.allowed-origins to allow browser clients from other origins.
• The configured list replaces the loopback defaults.
• Applications providing their own Spring AI transport provider must configure their own Origin validator.
• This Spring Boot transport change does not affect the Quarkus engine.

This is a documentation-only change accompanying the CAMEL-26360 Spring Boot MCP server parity work.

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[gnodet-bot]

LGTM for content and structure. Two minor doc clarity notes below.

This review was generated by an AI agent, Hermès on behalf of @gnodet.

[ramu11]

Thanks for the review! Addressed both documentation suggestions:

• Clarified that Spring AI's Streamable HTTP transport validates the Origin header for POST, SSE GET, and DELETE requests, including the behavior for missing and disallowed origins.
• Aligned the wording to “the loopback default”.
  Updated in the latest commit.

[gnodet-bot]

Following up on my earlier review — both issues have been addressed.

• "in the same way" vague wording — ✅ addressed. The paragraph was rewritten with concrete specifics: Spring AI's Streamable HTTP transport validates the Origin header on POST, SSE GET, and DELETE requests, with explicit 403 behavior for disallowed origins.
• "loopback defaults" plural — ✅ addressed. Now reads "the loopback default" (singular), consistent with the preceding paragraph.

The new content is clear, accurate, and well-structured. LGTM.

This review was generated by an AI agent, Hermès on behalf of @gnodet.

[github-actions]

🧪 CI tested the following changed modules:

• docs

---

🔬 Scalpel shadow comparison — Scalpel: 0 of 726 tested, 0 compile-only — current: 0 all tested

Maveniverse Scalpel detected 0 affected modules (current approach: 0).

Skip-tests mode would test 0 modules (1 direct + 0 downstream), skip tests for 0 (generated code, meta-modules)

Modules Scalpel would test (0)

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

---

⚙️ View full build and test results

[davsclaus]

Thanks for following up on the camel-spring-boot review. I checked each statement against apache/camel-spring-boot#2094 (CamelMcpServerTransportAutoConfiguration and its Origin tests), and they all match: the methods that are checked, requests without an Origin header being accepted, the 403, the loopback default that camel.mcp-server.allowed-origins replaces, and that an application's own provider bean has to bring its own validator.

The one thing to watch is merge order. The text describes apache/camel-spring-boot#2094, which is still open, so this PR should merge after it (or at the same time). Otherwise the 4.24 upgrade guide describes a check the starter does not have yet.

Small optional points:

• The new paragraphs wrap at about 70 columns; the rest of the entry wraps at 120.
• It could say that the entry rules are the same as on Camel Main (+*+ or a malformed entry fails the startup), since the starter uses the same McpServerOrigins parser.
• Origin in the last paragraph could be in backticks, as it is everywhere else in the entry.

Claude Code on behalf of davsclaus. This review was generated by an AI agent and may contain inaccuracies; please verify all suggestions before applying.

[ramu11]

Thanks for the review. Addressed all three documentation suggestions:

• Matched the surrounding 120-column line-wrapping convention.
• Clarified that +*+ and malformed allowed-origin entries fail startup, consistent with Camel Main.
• Used backticks around Origin consistently.

The documentation updates are committed and pushed.

[davsclaus]

Thanks @ramu11, all three of my earlier points are in: the 120-column wrap, the same entry rules as Camel Main, and Origin in backticks. The "fail startup" sentence holds: createOriginHeaderValidator calls McpServerOrigins.parseAllowedOrigins while it builds the transport bean, which throws for * and malformed entries.

One thing changed under the text, though. Since my last review apache/camel-spring-boot#2094 added CamelMcpServerTransportCondition (9554026). Camel's transport, and with it the Origin validator, is now only installed with spring.ai.mcp.server.protocol=STREAMABLE and either camel.mcp-server.tags set or camel.mcp-server.transport-enabled=true. With no tags and transport-enabled unset, Spring AI's own provider stays and no Origin check is installed; the starter's usage.adoc says so on purpose.

So the first sentence at line 260 ("Spring Boot applications using camel-mcp-server-starter with Spring AI's Streamable HTTP transport also validate the Origin header on every request") is now broader than the code. Something like this would match #2094 as it stands:

Spring Boot applications using `camel-mcp-server-starter` validate the `Origin` header the same way when Camel's
Streamable HTTP transport is used: with `spring.ai.mcp.server.protocol=STREAMABLE` and either `camel.mcp-server.tags`
set or `camel.mcp-server.transport-enabled=true`. The check covers every request (`POST`, the SSE `GET`, and `DELETE`).
Requests without an `Origin` header are accepted. Requests with an `Origin` header are accepted only when the origin
matches the allowed list; other origins receive HTTP 403. By default, only loopback origins are allowed. Without tags
and with `transport-enabled` unset, or with `transport-enabled=false`, Spring AI's own transport is kept and no
`Origin` check is installed. Configure `camel.mcp-server.allowed-origins` to allow browser clients from other
origins, for example:

The rest still matches. As before, this should merge after apache/camel-spring-boot#2094; that PR is still changing, so one last check of the text against its final head before merging is worth it.

Claude Code on behalf of davsclaus. This review was generated by an AI agent and may contain inaccuracies; please verify all suggestions before applying.