Skip to content

Commit 6cd91c1

Browse files
ez-lbzez-lbz
committed
fix: validate MCP-Protocol-Version header in servlet transports
1 parent 8ee8ccb commit 6cd91c1

4 files changed

Lines changed: 326 additions & 0 deletions

File tree

‎mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStatelessServerTransport.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import io.modelcontextprotocol.common.McpTransportContext;
2020
import io.modelcontextprotocol.server.McpStatelessServerHandler;
2121
import io.modelcontextprotocol.server.McpTransportContextExtractor;
22+
import io.modelcontextprotocol.spec.HttpHeaders;
2223
import io.modelcontextprotocol.spec.McpError;
2324
import io.modelcontextprotocol.spec.McpSchema;
2425
import io.modelcontextprotocol.spec.McpStatelessServerTransport;
@@ -133,6 +134,10 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
133134
return;
134135
}
135136

137+
if (!validateProtocolVersion(request, response)) {
138+
return;
139+
}
140+
136141
try {
137142
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
138143
this.securityValidator.validateHeaders(headers);
@@ -240,6 +245,31 @@ private void responseError(HttpServletResponse response, int httpCode, McpError
240245
writer.flush();
241246
}
242247

248+
/**
249+
* Validates the {@code MCP-Protocol-Version} header against the protocol versions
250+
* supported by this transport. A missing header is allowed and falls back to the
251+
* negotiated protocol version, while a header carrying an unsupported version is
252+
* rejected with a 400 Bad Request.
253+
* @param request the HTTP servlet request
254+
* @param response the HTTP servlet response
255+
* @return true if the header is missing or contains a supported version, false if a
256+
* 400 error response has been written
257+
* @throws IOException if an I/O error occurs
258+
*/
259+
private boolean validateProtocolVersion(HttpServletRequest request, HttpServletResponse response)
260+
throws IOException {
261+
String protocolVersion = request.getHeader(HttpHeaders.PROTOCOL_VERSION);
262+
if (protocolVersion == null || this.protocolVersions().contains(protocolVersion)) {
263+
return true;
264+
}
265+
this.responseError(response, HttpServletResponse.SC_BAD_REQUEST,
266+
McpError.builder(McpSchema.ErrorCodes.METHOD_NOT_FOUND)
267+
.message("Unsupported protocol version (supported versions: "
268+
+ String.join(", ", this.protocolVersions()) + ")")
269+
.build());
270+
return false;
271+
}
272+
243273
/**
244274
* Cleans up resources when the servlet is being destroyed.
245275
* <p>

‎mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,10 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
262262
return;
263263
}
264264

265+
if (!validateProtocolVersion(request, response)) {
266+
return;
267+
}
268+
265269
try {
266270
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
267271
this.securityValidator.validateHeaders(headers);
@@ -398,6 +402,10 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
398402
return;
399403
}
400404

405+
if (!validateProtocolVersion(request, response)) {
406+
return;
407+
}
408+
401409
try {
402410
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
403411
this.securityValidator.validateHeaders(headers);
@@ -579,6 +587,10 @@ protected void doDelete(HttpServletRequest request, HttpServletResponse response
579587
return;
580588
}
581589

590+
if (!validateProtocolVersion(request, response)) {
591+
return;
592+
}
593+
582594
try {
583595
Map<String, List<String>> headers = HttpServletRequestUtils.extractHeaders(request);
584596
this.securityValidator.validateHeaders(headers);
@@ -640,6 +652,31 @@ public void responseError(HttpServletResponse response, int httpCode, McpError m
640652
return;
641653
}
642654

655+
/**
656+
* Validates the {@code MCP-Protocol-Version} header against the protocol versions
657+
* supported by this provider. A missing header is allowed and falls back to the
658+
* negotiated protocol version, while a header carrying an unsupported version is
659+
* rejected with a 400 Bad Request.
660+
* @param request the HTTP servlet request
661+
* @param response the HTTP servlet response
662+
* @return true if the header is missing or contains a supported version, false if a
663+
* 400 error response has been written
664+
* @throws IOException if an I/O error occurs
665+
*/
666+
private boolean validateProtocolVersion(HttpServletRequest request, HttpServletResponse response)
667+
throws IOException {
668+
String protocolVersion = request.getHeader(HttpHeaders.PROTOCOL_VERSION);
669+
if (protocolVersion == null || this.protocolVersions().contains(protocolVersion)) {
670+
return true;
671+
}
672+
this.responseError(response, HttpServletResponse.SC_BAD_REQUEST,
673+
McpError.builder(McpSchema.ErrorCodes.METHOD_NOT_FOUND)
674+
.message("Unsupported protocol version (supported versions: "
675+
+ String.join(", ", this.protocolVersions()) + ")")
676+
.build());
677+
return false;
678+
}
679+
643680
/**
644681
* Sends an SSE event to a client with a specific ID.
645682
* @param writer The writer to send the event through

‎mcp-core/src/test/java/io/modelcontextprotocol/server/transport/HttpServletStatelessServerTransportTests.java‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
/*
2+
* Copyright 2024-2026 the original author or authors.
3+
*/
4+
5+
package io.modelcontextprotocol.server.transport;
6+
7+
import java.io.BufferedReader;
8+
import java.io.PrintWriter;
9+
import java.io.StringReader;
10+
import java.io.StringWriter;
11+
12+
import jakarta.servlet.http.HttpServletRequest;
13+
import jakarta.servlet.http.HttpServletResponse;
14+
import org.junit.jupiter.api.BeforeEach;
15+
import org.junit.jupiter.api.Nested;
16+
import org.junit.jupiter.api.Test;
17+
import org.junit.jupiter.params.ParameterizedTest;
18+
import org.junit.jupiter.params.provider.ValueSource;
19+
20+
import io.modelcontextprotocol.spec.HttpHeaders;
21+
import io.modelcontextprotocol.spec.ProtocolVersions;
22+
23+
import static org.assertj.core.api.Assertions.assertThat;
24+
import static org.mockito.Mockito.mock;
25+
import static org.mockito.Mockito.verify;
26+
import static org.mockito.Mockito.when;
27+
28+
/**
29+
* Unit tests for {@link HttpServletStatelessServerTransport} HTTP request header
30+
* validation.
31+
*/
32+
class HttpServletStatelessServerTransportTests {
33+
34+
private final HttpServletStatelessServerTransport transport = HttpServletStatelessServerTransport.builder()
35+
.build();
36+
37+
private final HttpServletRequest request = mock(HttpServletRequest.class);
38+
39+
private final HttpServletResponse response = mock(HttpServletResponse.class);
40+
41+
private final StringWriter responseBody = new StringWriter();
42+
43+
@BeforeEach
44+
void setUp() throws Exception {
45+
when(request.getRequestURI()).thenReturn("/mcp");
46+
when(response.getWriter()).thenReturn(new PrintWriter(responseBody));
47+
}
48+
49+
@Nested
50+
class ProtocolVersionHeader {
51+
52+
@ParameterizedTest
53+
@ValueSource(strings = { ProtocolVersions.MCP_2024_11_05, ProtocolVersions.MCP_2025_03_26,
54+
ProtocolVersions.MCP_2025_06_18, ProtocolVersions.MCP_2025_11_25 })
55+
void doPostWithSupportedProtocolVersionProceeds(String protocolVersion) throws Exception {
56+
when(request.getHeader(HttpHeaders.PROTOCOL_VERSION)).thenReturn(protocolVersion);
57+
when(request.getHeader(HttpServletStatelessServerTransport.ACCEPT))
58+
.thenReturn("application/json, text/event-stream");
59+
when(request.getReader()).thenReturn(new BufferedReader(new StringReader("")));
60+
61+
transport.doPost(request, response);
62+
63+
assertThat(responseBody.toString())
64+
.as("a supported protocol version must not be rejected")
65+
.doesNotContain("Unsupported protocol version")
66+
.contains("Invalid message format");
67+
}
68+
69+
@ParameterizedTest
70+
@ValueSource(strings = { "banana", "1999-01-01" })
71+
void doPostWithUnsupportedProtocolVersionRejected(String protocolVersion) throws Exception {
72+
when(request.getHeader(HttpHeaders.PROTOCOL_VERSION)).thenReturn(protocolVersion);
73+
74+
transport.doPost(request, response);
75+
76+
verify(response).setStatus(HttpServletResponse.SC_BAD_REQUEST);
77+
assertThat(responseBody.toString()).contains("Unsupported protocol version");
78+
}
79+
80+
@Test
81+
void doPostWithMissingProtocolVersionProceeds() throws Exception {
82+
when(request.getHeader(HttpServletStatelessServerTransport.ACCEPT))
83+
.thenReturn("application/json, text/event-stream");
84+
when(request.getReader()).thenReturn(new BufferedReader(new StringReader("")));
85+
86+
transport.doPost(request, response);
87+
88+
assertThat(responseBody.toString())
89+
.as("a missing protocol version must fall back to the negotiated version")
90+
.doesNotContain("Unsupported protocol version")
91+
.contains("Invalid message format");
92+
}
93+
94+
}
95+
96+
}

‎mcp-core/src/test/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProviderTests.java‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
/*
2+
* Copyright 2024-2026 the original author or authors.
3+
*/
4+
5+
package io.modelcontextprotocol.server.transport;
6+
7+
import java.io.BufferedReader;
8+
import java.io.PrintWriter;
9+
import java.io.StringReader;
10+
import java.io.StringWriter;
11+
12+
import jakarta.servlet.http.HttpServletRequest;
13+
import jakarta.servlet.http.HttpServletResponse;
14+
import org.junit.jupiter.api.BeforeEach;
15+
import org.junit.jupiter.api.Nested;
16+
import org.junit.jupiter.api.Test;
17+
import org.junit.jupiter.params.ParameterizedTest;
18+
import org.junit.jupiter.params.provider.ValueSource;
19+
20+
import io.modelcontextprotocol.spec.HttpHeaders;
21+
import io.modelcontextprotocol.spec.ProtocolVersions;
22+
23+
import static org.assertj.core.api.Assertions.assertThat;
24+
import static org.mockito.Mockito.mock;
25+
import static org.mockito.Mockito.verify;
26+
import static org.mockito.Mockito.when;
27+
28+
/**
29+
* Unit tests for {@link HttpServletStreamableServerTransportProvider} HTTP request header
30+
* validation.
31+
*/
32+
class HttpServletStreamableServerTransportProviderTests {
33+
34+
private final HttpServletStreamableServerTransportProvider transport = HttpServletStreamableServerTransportProvider
35+
.builder()
36+
.build();
37+
38+
private final HttpServletRequest request = mock(HttpServletRequest.class);
39+
40+
private final HttpServletResponse response = mock(HttpServletResponse.class);
41+
42+
private final StringWriter responseBody = new StringWriter();
43+
44+
@BeforeEach
45+
void setUp() throws Exception {
46+
when(request.getRequestURI()).thenReturn("/mcp");
47+
when(response.getWriter()).thenReturn(new PrintWriter(responseBody));
48+
}
49+
50+
@Nested
51+
class ProtocolVersionHeader {
52+
53+
@ParameterizedTest
54+
@ValueSource(strings = { ProtocolVersions.MCP_2024_11_05, ProtocolVersions.MCP_2025_03_26,
55+
ProtocolVersions.MCP_2025_06_18, ProtocolVersions.MCP_2025_11_25 })
56+
void doGetWithSupportedProtocolVersionProceeds(String protocolVersion) throws Exception {
57+
when(request.getHeader(HttpHeaders.PROTOCOL_VERSION)).thenReturn(protocolVersion);
58+
59+
transport.doGet(request, response);
60+
61+
assertThat(responseBody.toString())
62+
.as("a supported protocol version must not be rejected")
63+
.doesNotContain("Unsupported protocol version")
64+
.contains("Session ID required in mcp-session-id header");
65+
}
66+
67+
@ParameterizedTest
68+
@ValueSource(strings = { "banana", "1999-01-01" })
69+
void doGetWithUnsupportedProtocolVersionRejected(String protocolVersion) throws Exception {
70+
when(request.getHeader(HttpHeaders.PROTOCOL_VERSION)).thenReturn(protocolVersion);
71+
72+
transport.doGet(request, response);
73+
74+
verify(response).setStatus(HttpServletResponse.SC_BAD_REQUEST);
75+
assertThat(responseBody.toString()).contains("Unsupported protocol version");
76+
}
77+
78+
@Test
79+
void doGetWithMissingProtocolVersionProceeds() throws Exception {
80+
transport.doGet(request, response);
81+
82+
assertThat(responseBody.toString())
83+
.as("a missing protocol version must fall back to the negotiated version")
84+
.doesNotContain("Unsupported protocol version")
85+
.contains("Session ID required in mcp-session-id header");
86+
}
87+
88+
@ParameterizedTest
89+
@ValueSource(strings = { ProtocolVersions.MCP_2024_11_05, ProtocolVersions.MCP_2025_03_26,
90+
ProtocolVersions.MCP_2025_06_18, ProtocolVersions.MCP_2025_11_25 })
91+
void doPostWithSupportedProtocolVersionProceeds(String protocolVersion) throws Exception {
92+
when(request.getHeader(HttpHeaders.PROTOCOL_VERSION)).thenReturn(protocolVersion);
93+
when(request.getReader()).thenReturn(new BufferedReader(new StringReader("")));
94+
95+
transport.doPost(request, response);
96+
97+
assertThat(responseBody.toString())
98+
.as("a supported protocol version must not be rejected")
99+
.doesNotContain("Unsupported protocol version")
100+
.contains("Invalid message format");
101+
}
102+
103+
@ParameterizedTest
104+
@ValueSource(strings = { "banana", "1999-01-01" })
105+
void doPostWithUnsupportedProtocolVersionRejected(String protocolVersion) throws Exception {
106+
when(request.getHeader(HttpHeaders.PROTOCOL_VERSION)).thenReturn(protocolVersion);
107+
108+
transport.doPost(request, response);
109+
110+
verify(response).setStatus(HttpServletResponse.SC_BAD_REQUEST);
111+
assertThat(responseBody.toString()).contains("Unsupported protocol version");
112+
}
113+
114+
@Test
115+
void doPostWithMissingProtocolVersionProceeds() throws Exception {
116+
when(request.getReader()).thenReturn(new BufferedReader(new StringReader("")));
117+
118+
transport.doPost(request, response);
119+
120+
assertThat(responseBody.toString())
121+
.as("a missing protocol version must fall back to the negotiated version")
122+
.doesNotContain("Unsupported protocol version")
123+
.contains("Invalid message format");
124+
}
125+
126+
@ParameterizedTest
127+
@ValueSource(strings = { ProtocolVersions.MCP_2024_11_05, ProtocolVersions.MCP_2025_03_26,
128+
ProtocolVersions.MCP_2025_06_18, ProtocolVersions.MCP_2025_11_25 })
129+
void doDeleteWithSupportedProtocolVersionProceeds(String protocolVersion) throws Exception {
130+
when(request.getHeader(HttpHeaders.PROTOCOL_VERSION)).thenReturn(protocolVersion);
131+
132+
transport.doDelete(request, response);
133+
134+
assertThat(responseBody.toString())
135+
.as("a supported protocol version must not be rejected")
136+
.doesNotContain("Unsupported protocol version")
137+
.contains("Session ID required in mcp-session-id header");
138+
}
139+
140+
@ParameterizedTest
141+
@ValueSource(strings = { "banana", "1999-01-01" })
142+
void doDeleteWithUnsupportedProtocolVersionRejected(String protocolVersion) throws Exception {
143+
when(request.getHeader(HttpHeaders.PROTOCOL_VERSION)).thenReturn(protocolVersion);
144+
145+
transport.doDelete(request, response);
146+
147+
verify(response).setStatus(HttpServletResponse.SC_BAD_REQUEST);
148+
assertThat(responseBody.toString()).contains("Unsupported protocol version");
149+
}
150+
151+
@Test
152+
void doDeleteWithMissingProtocolVersionProceeds() throws Exception {
153+
transport.doDelete(request, response);
154+
155+
assertThat(responseBody.toString())
156+
.as("a missing protocol version must fall back to the negotiated version")
157+
.doesNotContain("Unsupported protocol version")
158+
.contains("Session ID required in mcp-session-id header");
159+
}
160+
161+
}
162+
163+
}

0 commit comments

Comments
 (0)