Title: fix(client): send same-origin Origin header from streamable HTTP client by Bartok9 · Pull Request #2729 · modelcontextprotocol/python-sdk · GitHub
Open Graph Title: fix(client): send same-origin Origin header from streamable HTTP client by Bartok9 · Pull Request #2729 · modelcontextprotocol/python-sdk
X Title: fix(client): send same-origin Origin header from streamable HTTP client by Bartok9 · Pull Request #2729 · modelcontextprotocol/python-sdk
Description: Summary The streamable HTTP client now sends a same-origin Origin header by default. This lets the official Python client interoperate with spec-compliant servers (e.g. the Go SDK's http.CrossOriginProtection) that otherwise reject the handshake with 403. Motivation Closes #2727. The Python streamablehttp_client opened its POST handshake without an Origin header. The official Go SDK (modelcontextprotocol/go-sdk v1.4.x) wraps every streamable-HTTP handler with Go 1.25's http.CrossOriginProtection, which denies any state-changing request that cannot prove same-origin via Sec-Fetch-Site, a matching Origin, or an allow-listed origin. A legitimate server-to-server connection from the Python client therefore looks like a CSRF attempt → HTTP 403 Forbidden on the first POST, and the client (per #2110) swallows the non-2xx and hangs forever on session.initialize(). The two reference SDKs from the same org were out of sync by one spec revision: the Go server enforces the rule; the Python client never sent the header that satisfies it. Fix StreamableHTTPTransport._prepare_headers() now derives a same-origin value (scheme://host[:port]) from the target URL and sends it as the Origin header on every request. The derivation: Uses urllib.parse.urlsplit on the configured URL. Returns None (adds no header) when the URL has no scheme or host, so malformed/relative URLs are unaffected. Callers needing a different Origin (e.g. multi-tenant proxies) can still set one on the underlying httpx.AsyncClient default headers. Verification uv run pytest tests/shared/test_streamable_http.py — 63 passed (includes the existing test_streamable_http_client_mcp_headers_override_defaults / custom-header tests, unchanged). New tests: test_prepare_headers_includes_same_origin — http://my-go-server:8081/mcp → Origin: http://my-go-server:8081; https://…/path?x=1 → https://example.com. test_prepare_headers_omits_origin_for_invalid_url — no Origin added for a URL lacking scheme/host. uv run ruff check / ruff format --check — clean. Diff: 2 files, +41/-0.
Open Graph Description: Summary The streamable HTTP client now sends a same-origin Origin header by default. This lets the official Python client interoperate with spec-compliant servers (e.g. the Go SDK's http.Cross...
X Description: Summary The streamable HTTP client now sends a same-origin Origin header by default. This lets the official Python client interoperate with spec-compliant servers (e.g. the Go SDK's http.C...
Opengraph URL: https://github.com/modelcontextprotocol/python-sdk/pull/2729
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:afa499a8-da92-1d03-9f4f-a64ceb614787 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | A584:10B5C2:3EA84A:51FB93:6A5B2377 |
| html-safe-nonce | 6ae54a941610cfb62b88a7a04c5e9ce43ede933162c49ba1e6c569a573e561df |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBNTg0OjEwQjVDMjozRUE4NEE6NTFGQjkzOjZBNUIyMzc3IiwidmlzaXRvcl9pZCI6IjM0NjU2ODkwOTgxMDI3MTExNTkiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ== |
| visitor-hmac | e31871a65fe58259cbe8c62fc61d3eeade7e35fa4fca391581d5648673a42716 |
| hovercard-subject-tag | pull_request:3773205119 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/modelcontextprotocol/python-sdk/pull/2729/files |
| twitter:image | https://avatars.githubusercontent.com/u/259807879?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/259807879?s=400&v=4 |
| og:image:alt | Summary The streamable HTTP client now sends a same-origin Origin header by default. This lets the official Python client interoperate with spec-compliant servers (e.g. the Go SDK's http.Cross... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 5290d7e14309ad1e76106a9c4237bd1041517e83ea182c8ab756752cb0c6940b |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/modelcontextprotocol/python-sdk git https://github.com/modelcontextprotocol/python-sdk.git |
| octolytics-dimension-user_id | 182288589 |
| octolytics-dimension-user_login | modelcontextprotocol |
| octolytics-dimension-repository_id | 862584018 |
| octolytics-dimension-repository_nwo | modelcontextprotocol/python-sdk |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 862584018 |
| octolytics-dimension-repository_network_root_nwo | modelcontextprotocol/python-sdk |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 9c975978430e9ad293956f2bbdaf153b1bd84a99 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width