Add MCP HTTP header passthrough support - #243
Merged
Merged
Conversation
❌ Code Formatting Check FailedSome files in this PR are not properly formatted according to the project's clang-format rules. To fix this issue: make formatThen commit and push the changes. |
Collaborator
|
@bettercallsaulj thanks for the work, but once again, please log a ticket to explain the origin of this work. Or the PR can't be merged, unless the community is on the same page. And please change the title to reflect the work properly. |
bettercallsaulj
force-pushed
the
fix_tls_issue
branch
from
July 6, 2026 17:08
88493b0 to
886f99e
Compare
bettercallsaulj
force-pushed
the
feature_token_protect
branch
from
July 6, 2026 17:12
caa3a75 to
3901ef2
Compare
Collaborator
Author
Done |
bettercallsaulj
force-pushed
the
fix_tls_issue
branch
2 times, most recently
from
July 7, 2026 04:04
9ecbf17 to
d08091d
Compare
bettercallsaulj
force-pushed
the
feature_token_protect
branch
from
July 7, 2026 04:20
3901ef2 to
2f40053
Compare
dIvYaNshhh
reviewed
Jul 7, 2026
bettercallsaulj
force-pushed
the
fix_tls_issue
branch
from
July 7, 2026 14:13
d08091d to
0824cf8
Compare
bettercallsaulj
force-pushed
the
feature_token_protect
branch
from
July 7, 2026 14:15
2f40053 to
d088a49
Compare
dIvYaNshhh
previously approved these changes
Jul 7, 2026
dIvYaNshhh
left a comment
dIvYaNshhh
left a comment
Collaborator
There was a problem hiding this comment.
LGTM ✅ — all previously raised findings are addressed. Thanks for the thorough fixes.
added 7 commits
July 8, 2026 17:13
Summary: - Add default HTTP header storage to MCP client and connection configuration so SDK-created clients can send runtime Authorization headers. - Add per-request HTTP header overloads for sendRequest, listTools, and callTool so gateway callers can pass the client bearer token through to backend MCP servers. - Propagate configured and per-request headers into HTTP/SSE and streamable HTTP request formatting, with per-request headers overriding static defaults. - Preserve generated transport headers such as Host, Content-Type, Content-Length, Accept, Connection, User-Agent, and Cache-Control.
Summary: Validate client-supplied HTTP headers before the codec serializes them so names or values containing CR, LF, or NUL cannot inject extra header lines or smuggle another request. Add regression coverage for CRLF and NUL header injection attempts while preserving valid passthrough headers.
Summary: Treat Transfer-Encoding as a generated HTTP client header so caller-supplied values cannot be serialized alongside the codec's generated Content-Length. Expose the generated-header predicate for reuse and extend header compatibility coverage for the chunked smuggling case.
Summary: Make McpConnectionManager's direct HTTP POST path use the same client header validation and generated-header blocklist as HttpCodecFilter, including Transfer-Encoding filtering. Add a loopback regression that verifies valid headers pass while CRLF, NUL, Content-Length, and Transfer-Encoding headers are omitted on the wire.
Summary: Reset the shared HTTP client header source back to base headers immediately after each connection-manager write so per-request headers such as Authorization cannot leak into later requests. Add regression coverage that a second codec write with a cleared header source does not reuse the previous request's Authorization value.
Summary: Apply formatting updates to the HTTP codec header filtering code and connection manager header regression test after the header safety fixes.
bettercallsaulj
force-pushed
the
feature_token_protect
branch
from
July 8, 2026 09:14
d088a49 to
0f850c1
Compare
dIvYaNshhh
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR must be merged after #242.
Detail:
Add MCP HTTP header passthrough support (#250)