Skip to content

Fix modern servlet transport Content-Type validation - #1207

Open
tarun-agarwal1044 wants to merge 1 commit into
modelcontextprotocol:mainfrom
tarun-agarwal1044:fix/1206-modern-servlet-content-type
Open

tarun-agarwal1044 wants to merge 1 commit into
modelcontextprotocol:mainfrom
tarun-agarwal1044:fix/1206-modern-servlet-content-type

Conversation

@tarun-agarwal1044

Copy link
Copy Markdown

Summary

  • Reject modern servlet POST requests with missing, empty, or non-JSON Content-Type with HTTP 415 before extracting context or reading the body.
  • Make the existing internal servlet Content-Type matcher accessible across packages, keeping legacy and modern matching identical.
  • Add integration coverage for invalid media types and JSON media types with parameters or mixed case.

Fixes #1206

Validation

  • Confirmed all eight invalid Content-Type regression cases returned 200 before the fix.
  • Passed: ./mvnw -q -pl mcp-test -am -Dtest=HttpServletRequestUtilsTests,HttpServletMcpTransportIntegrationTests,HttpServletMcpTransportThreadLocalIntegrationTests,HttpServletMcpTransportSlowClientIntegrationTests -Dsurefire.failIfNoSpecifiedTests=false test

Implemented with GitHub Copilot.

Reject POST requests without an application/json media type before reading the body. Share the existing servlet Content-Type matcher and cover invalid types, parameters, and case-insensitive matching.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Modern HttpServletMcpTransport accepts POST requests with non-JSON Content-Type

1 participant