From 2d943b047f83c4fb924de26aeb1a156d37eb2fdc Mon Sep 17 00:00:00 2001 From: ramu11 Date: Sat, 14 Nov 2026 17:07:15 +0530 Subject: [PATCH 1/3] CAMEL-26360: Document Spring Boot MCP origin validation --- .../pages/camel-4x-upgrade-guide-4_24.adoc | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc index 028422a474ff9..2378824fa281a 100644 --- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc +++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc @@ -255,8 +255,22 @@ By default only loopback origins are allowed (`localhost`, `127.0.0.1` and `[::1 client served from another origin must now be listed in the new `camel.server.mcp-allowed-origins` option, for example `+camel.server.mcp-allowed-origins = https://app.example.com, http://localhost:*+`. The list replaces the loopback default. Scheme and host are compared ignoring case and a default port may be left out; `+*+` and other entries that are -not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected, and neither are the Spring Boot and -Quarkus engines. +not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected. + +Spring Boot applications using `camel-mcp-server-starter` with Spring AI's +Streamable HTTP transport now check the `Origin` header in the same way. By +default, only loopback origins are allowed. Configure +`camel.mcp-server.allowed-origins` to allow browser clients from other origins, +for example: + +[source,properties] +---- +camel.mcp-server.allowed-origins = https://app.example.com, http://localhost:* +---- + +The configured list replaces the loopback defaults. An application-provided +Spring AI transport provider must configure its own Origin validator. This +Spring Boot transport change does not affect the Quarkus engine. === camel-oauth - the scp claim is included in scope checks From 392374549e36e8a2e94ccdddb2bfbf8cc8fb2486 Mon Sep 17 00:00:00 2001 From: ramu11 Date: Sat, 14 Nov 2026 17:20:09 +0530 Subject: [PATCH 2/3] CAMEL-26360: Clarify Spring Boot MCP origin docs --- .../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc index 2378824fa281a..eae3f32fe05e4 100644 --- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc +++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc @@ -258,17 +258,19 @@ default. Scheme and host are compared ignoring case and a default port may be le not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected. Spring Boot applications using `camel-mcp-server-starter` with Spring AI's -Streamable HTTP transport now check the `Origin` header in the same way. By -default, only loopback origins are allowed. Configure -`camel.mcp-server.allowed-origins` to allow browser clients from other origins, -for example: +Streamable HTTP transport also validate the `Origin` header on every request +(`POST`, the SSE `GET`, and `DELETE`). Requests without an `Origin` header are +accepted. Requests with an `Origin` header are accepted only when the origin +matches the allowed list; other origins receive HTTP 403. By default, only +loopback origins are allowed. Configure `camel.mcp-server.allowed-origins` to +allow browser clients from other origins, for example: [source,properties] ---- camel.mcp-server.allowed-origins = https://app.example.com, http://localhost:* ---- -The configured list replaces the loopback defaults. An application-provided +The configured list replaces the loopback default. An application-provided Spring AI transport provider must configure its own Origin validator. This Spring Boot transport change does not affect the Quarkus engine. From 8d9c736757f8904d97085689a025cbb4fe36aa31 Mon Sep 17 00:00:00 2001 From: ramu11 Date: Sun, 15 Nov 2026 11:20:52 +0530 Subject: [PATCH 3/3] CAMEL-26360: Clarify Spring Boot MCP Origin validation docs --- .../pages/camel-4x-upgrade-guide-4_24.adoc | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc index eae3f32fe05e4..3f5a33d8687c0 100644 --- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc +++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc @@ -257,22 +257,21 @@ client served from another origin must now be listed in the new `camel.server.mc default. Scheme and host are compared ignoring case and a default port may be left out; `+*+` and other entries that are not of the form `scheme://host[:port]` fail the startup. Stdio mode is not affected. -Spring Boot applications using `camel-mcp-server-starter` with Spring AI's -Streamable HTTP transport also validate the `Origin` header on every request -(`POST`, the SSE `GET`, and `DELETE`). Requests without an `Origin` header are -accepted. Requests with an `Origin` header are accepted only when the origin -matches the allowed list; other origins receive HTTP 403. By default, only -loopback origins are allowed. Configure `camel.mcp-server.allowed-origins` to -allow browser clients from other origins, for example: +Spring Boot applications using `camel-mcp-server-starter` with Spring AI's Streamable HTTP transport also validate the +`Origin` header on every request (`POST`, the SSE `GET`, and `DELETE`). Requests without an `Origin` header are +accepted. Requests with an `Origin` header are accepted only when the origin matches the allowed list; other origins +receive HTTP 403. By default, only loopback origins are allowed. Configure `camel.mcp-server.allowed-origins` to allow +browser clients from other origins, for example: [source,properties] ---- camel.mcp-server.allowed-origins = https://app.example.com, http://localhost:* ---- -The configured list replaces the loopback default. An application-provided -Spring AI transport provider must configure its own Origin validator. This -Spring Boot transport change does not affect the Quarkus engine. +The configured list replaces the loopback default. The allowed-origin entries follow the same rules as on Camel Main: +the wildcard entry `+*+` and entries not of the form `scheme://host[:port]` fail startup. An application-provided +Spring AI transport provider must configure its own `Origin` validator. This Spring Boot transport change does not +affect the Quarkus engine. === camel-oauth - the scp claim is included in scope checks