feat: Add CORS configuration for browser-based MCP clients #1059
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Kludex
reviewed
Jul 4, 2025
Comment on lines
135
to
142
|
|
||
| # Add CORS middleware to expose Mcp-Session-Id header for browser-based clients | ||
| starlette_app.add_middleware( | ||
| CORSMiddleware, | ||
| allow_origins=["*"], # Allow all origins - adjust as needed for production | ||
| allow_methods=["GET", "POST", "DELETE"], # MCP streamable HTTP methods | ||
| expose_headers=["Mcp-Session-Id"], | ||
| ) |
There was a problem hiding this comment.
You need to wrap the whole application instead of using add_middleware, otherwise 500s don't get in this.
- Add CORSMiddleware to streamable HTTP example servers - Configure minimal CORS with Mcp-Session-Id exposed - Add CORS documentation section to README This enables browser-based clients to connect to MCP servers by properly exposing the Mcp-Session-Id header required for session management. Reported-by: Jerome
jerome3o-anthropic
force-pushed
the
jerome/cors-browser-support
branch
from
7a554e7 to
28aaa02
Compare
felixweinberger
requested review from
felixweinberger
and removed request for
felixweinberger
Co-authored-by: Marcelo Trylesinski <[email protected]>
Kludex
previously approved these changes
Jul 7, 2025
felixweinberger
previously requested changes
Jul 9, 2025
That's a flaky test. |
|
We still need to address comment in #1059 (comment) for examples, only readme was changed, right? |
- Change from add_middleware() to CORSMiddleware wrapper pattern - Ensures 500 errors get proper CORS headers for browser clients - Update both streamable HTTP example servers - Fix README documentation to show complete example Reported-by: Jerome
felixweinberger
previously approved these changes
Aug 21, 2025
felixweinberger
force-pushed
the
jerome/cors-browser-support
branch
from
1792336 to
bf7ab5f
Compare
rbehal
pushed a commit
to gumloop/gumloop-mcp
that referenced
this pull request
Sep 25, 2025
* Add regression test for stateless request memory cleanup (modelcontextprotocol#1140) * Implement RFC9728 - Support WWW-Authenticate header by MCP client (modelcontextprotocol#1071) * Add streamable HTTP starlette example to Python SDK docs (modelcontextprotocol#1111) * fix markdown error in README in main (modelcontextprotocol#1147) * README - replace code snippets with examples - add lowlevel to snippets (modelcontextprotocol#1150) * README - replace code snippets with examples - streamable http (modelcontextprotocol#1155) * chore: don't allow users to create issues outside the templates (modelcontextprotocol#1163) * Tests(cli): Add coverage for helper functions (modelcontextprotocol#635) * Docs: Update CallToolResult parsing in README (modelcontextprotocol#812) Co-authored-by: Felix Weinberger <[email protected]> * docs: add pre-commit install guide on CONTRIBUTING.md (modelcontextprotocol#995) Co-authored-by: Felix Weinberger <[email protected]> * fix flaky fix-test_streamablehttp_client_resumption test (modelcontextprotocol#1166) * README - replace code snippets with examples -- auth examples (modelcontextprotocol#1164) * Support falling back to OIDC metadata for auth (modelcontextprotocol#1061) * Add CODEOWNERS file for sdk (modelcontextprotocol#1169) * fix flaky test test_88_random_error (modelcontextprotocol#1171) * Make sure `RequestId` is not coerced as `int` (modelcontextprotocol#1178) * Fix: Replace threading.Lock with anyio.Lock for Ray deployment compatibility (modelcontextprotocol#1151) * fix: fix OAuth flow request object handling (modelcontextprotocol#1174) * update codeowners group (modelcontextprotocol#1191) * fix: perform auth server metadata discovery fallbacks on any 4xx (modelcontextprotocol#1193) * server: skip duplicate response on CancelledError (modelcontextprotocol#1153) Co-authored-by: ihrpr <[email protected]> * Unpack settings in FastMCP (modelcontextprotocol#1198) * chore: Remove unused prompt_manager.py file (modelcontextprotocol#1229) Co-authored-by: Tapan Chugh <[email protected]> * Improved supported for ProtectedResourceMetadata (modelcontextprotocol#1235) Co-authored-by: Paul Carleton <[email protected]> * chore: Remove unused variable notification_options (modelcontextprotocol#1238) * Improve README around the Context object (modelcontextprotocol#1203) * fix: allow to pass `list[str]` to `token_endpoint_auth_signing_alg_values_supported` (modelcontextprotocol#1226) * Remove strict validation on `response_modes_supported` member of `OAuthMetadata` (modelcontextprotocol#1243) * Add pyright strict mode on the whole project (modelcontextprotocol#1254) * Consistent casing for default headers Accept and Content-Type (modelcontextprotocol#1263) * Update dependencies and fix type issues (modelcontextprotocol#1268) Co-authored-by: Marcelo Trylesinski <[email protected]> * fix: prevent async generator cleanup errors in StreamableHTTP transport (modelcontextprotocol#1271) Co-authored-by: David Soria Parra <[email protected]> * chore: uncomment .idea/ in .gitignore (modelcontextprotocol#1287) Co-authored-by: Claude <[email protected]> * docs: clarify streamable_http_path configuration when mounting servers (modelcontextprotocol#1172) * feat: Add CORS configuration for browser-based MCP clients (modelcontextprotocol#1059) Co-authored-by: Marcelo Trylesinski <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Added Audio to FastMCP (modelcontextprotocol#1130) * fix: avoid uncessary retries in OAuth authenticated requests (modelcontextprotocol#1206) Co-authored-by: Felix Weinberger <[email protected]> * Add PATHEXT to default STDIO env vars in windows (modelcontextprotocol#1256) * fix: error too many values to unpack (expected 2) (modelcontextprotocol#1279) Signed-off-by: San Nguyen <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * SDK Parity: Avoid Parsing Server Response for non-JsonRPCMessage Requests (modelcontextprotocol#1290) * types: Setting default value for method: Literal (modelcontextprotocol#1292) * changes structured temperature to not deadly (modelcontextprotocol#1328) * Update simple-resource example to use non-deprecated read_resource return type (modelcontextprotocol#1331) Co-authored-by: Claude <[email protected]> * docs: Update README to include link to API docs for modelcontextprotocol#1329 (modelcontextprotocol#1330) * Allow ping requests before initialization (modelcontextprotocol#1312) * Python lint: Ruff rules for pylint and code complexity (modelcontextprotocol#525) * Fix context injection for resources and prompts (modelcontextprotocol#1336) * fix(fastmcp): propagate mimeType in resource template list (modelcontextprotocol#1186) Co-authored-by: Felix Weinberger <[email protected]> * fix: allow elicitations accepted without content (modelcontextprotocol#1285) Co-authored-by: Olivier Schiavo <[email protected]> * Use --frozen in pre-commit config (modelcontextprotocol#1375) * Return HTTP 403 for invalid Origin headers (modelcontextprotocol#1353) * Add test for ProtectedResourceMetadataParsing (modelcontextprotocol#1236) Co-authored-by: Paul Carleton <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Fastmcp logging progress example (modelcontextprotocol#1270) Co-authored-by: Felix Weinberger <[email protected]> * feat: add paginated list decorators for prompts, resources, and tools (modelcontextprotocol#1286) Co-authored-by: Claude <[email protected]> * Remove "unconditionally" from conditional description (modelcontextprotocol#1289) * Use streamable-http consistently in examples (modelcontextprotocol#1389) * feat: Add SDK support for SEP-1034 default values in elicitation schemas (modelcontextprotocol#1337) Co-authored-by: Tapan Chugh <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Implementation of SEP 973 - Additional metadata + icons support (modelcontextprotocol#1357) * Merge upstream/main with custom filtering --------- Signed-off-by: San Nguyen <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: yurikunash <[email protected]> Co-authored-by: Pamela Fox <[email protected]> Co-authored-by: Inna Harper <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> Co-authored-by: Ian Davenport <[email protected]> Co-authored-by: Dagang Wei <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Stanley Law <[email protected]> Co-authored-by: Luca Chang <[email protected]> Co-authored-by: leweng <[email protected]> Co-authored-by: Clare Liguori <[email protected]> Co-authored-by: lukacf <[email protected]> Co-authored-by: ihrpr <[email protected]> Co-authored-by: Tapan Chugh <[email protected]> Co-authored-by: Tapan Chugh <[email protected]> Co-authored-by: Yann Jouanin <[email protected]> Co-authored-by: Paul Carleton <[email protected]> Co-authored-by: Sreenath Somarajapuram <[email protected]> Co-authored-by: Omer Korner <[email protected]> Co-authored-by: joesavage-silabs <[email protected]> Co-authored-by: Gregory L <[email protected]> Co-authored-by: David Soria Parra <[email protected]> Co-authored-by: Moustapha Ebnou <[email protected]> Co-authored-by: Max Isbey <[email protected]> Co-authored-by: Claude <[email protected]> Co-authored-by: Jerome <[email protected]> Co-authored-by: xavier <[email protected]> Co-authored-by: keurcien <[email protected]> Co-authored-by: Tim Esler <[email protected]> Co-authored-by: San Nguyen <[email protected]> Co-authored-by: Justin Wang <[email protected]> Co-authored-by: jess <[email protected]> Co-authored-by: Peter Alexander <[email protected]> Co-authored-by: Reid Geyer <[email protected]> Co-authored-by: Eleftheria Stein-Kousathana <[email protected]> Co-authored-by: Christian Clauss <[email protected]> Co-authored-by: pchoudhury22 <[email protected]> Co-authored-by: owengo <[email protected]> Co-authored-by: Olivier Schiavo <[email protected]> Co-authored-by: Steve Billings <[email protected]> Co-authored-by: Mike Salvatore <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Mcp-Session-IdheaderProblem
Browser-based MCP clients cannot access the
Mcp-Session-Idheader from initialization responses due to CORS restrictions. Without this header, they cannot establish sessions with MCP servers.Solution
This PR adds Starlette's
CORSMiddlewareto the example servers and configures it to expose theMcp-Session-Idheader viaexpose_headers. The configuration is minimal, only allowing the HTTP methods required by the MCP protocol (GET, POST, DELETE).Changes
CORSMiddlewareimport and configuration to:examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.pyexamples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.pyTest plan
Mcp-Session-Idheader from responsesReported-by: Jerome