Title: Clarify HTTP 403 status for invalid Origin headers by pja-ant · Pull Request #1439 · modelcontextprotocol/modelcontextprotocol · GitHub
Open Graph Title: Clarify HTTP 403 status for invalid Origin headers by pja-ant · Pull Request #1439 · modelcontextprotocol/modelcontextprotocol
X Title: Clarify HTTP 403 status for invalid Origin headers by pja-ant · Pull Request #1439 · modelcontextprotocol/modelcontextprotocol
Description: Add explicit guidance that servers MUST respond with HTTP 403 Forbidden when the Origin header is present but invalid. This addresses part of issue #1398 regarding inconsistent error responses across SDKs. Currently TypeScript returns 403, but Python return 400. 403 seems like the most appropriate response here, so going with that (and will update Python if this is accepted). Motivation and Context Spec does not specify the response, so implementations have diverged. #1398 How Has This Been Tested? npm serve:docs Breaking Changes Technically this could be a breaking change if there are some clients somewhere are relying on specific implementation of this from specific SDKs, but since e.g. TypeScript SDK already returns 403, it's already behavior that clients have to deal with depending on the server. Marking as "breaking change" as a precaution, but I think this should be a safe change. Types of changes Bug fix (non-breaking change which fixes an issue) New feature (non-breaking change which adds functionality) Breaking change (fix or feature that would cause existing functionality to change) Documentation update Checklist I have read the MCP Documentation My code follows the repository's style guidelines New and existing tests pass locally I have added appropriate error handling I have added or updated documentation as needed
Open Graph Description: Add explicit guidance that servers MUST respond with HTTP 403 Forbidden when the Origin header is present but invalid. This addresses part of issue #1398 regarding inconsistent error responses acro...
X Description: Add explicit guidance that servers MUST respond with HTTP 403 Forbidden when the Origin header is present but invalid. This addresses part of issue #1398 regarding inconsistent error responses acro...
Opengraph URL: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1439
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:02aadb8c-5060-c52c-47a0-8bb08fab5ad1 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | C5AE:56614:3C192D0:52A00AE:6A5DFB45 |
| html-safe-nonce | f17f62d0ad414dc98f3ce734d924517824a806f61d82382c3cfcb50c926029de |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJDNUFFOjU2NjE0OjNDMTkyRDA6NTJBMDBBRTo2QTVERkI0NSIsInZpc2l0b3JfaWQiOiIzMjY4NzQ3ODg2NzU1NDQ1NTczIiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmVuZGVyIjoiaWFkIn0= |
| visitor-hmac | 58d6e45026d65ad986ecc5deba202689db3cb04eff7811524dbd3a938507bb71 |
| hovercard-subject-tag | pull_request:2808433365 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1439/files |
| twitter:image | https://avatars.githubusercontent.com/u/227474472?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/227474472?s=400&v=4 |
| og:image:alt | Add explicit guidance that servers MUST respond with HTTP 403 Forbidden when the Origin header is present but invalid. This addresses part of issue #1398 regarding inconsistent error responses acro... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 7c1de870f4c0eff05971cd22970403a1239a98dc1a35e52a43594f23fc4d546f |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/modelcontextprotocol/modelcontextprotocol git https://github.com/modelcontextprotocol/modelcontextprotocol.git |
| octolytics-dimension-user_id | 182288589 |
| octolytics-dimension-user_login | modelcontextprotocol |
| octolytics-dimension-repository_id | 862570523 |
| octolytics-dimension-repository_nwo | modelcontextprotocol/modelcontextprotocol |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 862570523 |
| octolytics-dimension-repository_network_root_nwo | modelcontextprotocol/modelcontextprotocol |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | e90635d4b07e4a20ff548df2e2bfea2179c6a3f3 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width