Reject non application/json POST requests

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>

Author: Kehrlann

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletRequestUtils.java

@@ -7,9 +7,14 @@
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.PrintWriter;
 import java.nio.charset.StandardCharsets;
 
+import io.modelcontextprotocol.json.McpJsonMapper;
+import io.modelcontextprotocol.spec.McpError;
+import io.modelcontextprotocol.spec.McpSchema;
 import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 /**
  * Utility methods for working with {@link HttpServletRequest}. For internal use only.
@@ -18,9 +23,53 @@
  */
 final class HttpServletRequestUtils {
 
+	private static final String APPLICATION_JSON = "application/json";
+
 	private HttpServletRequestUtils() {
 	}
 
+	/**
+	 * Checks whether a {@code Content-Type} header value denotes
+	 * {@code application/json}. Only the media type is compared, case-insensitively;
+	 * parameters such as {@code charset} are ignored. This is not a substring search, so
+	 * a value like {@code text/plain; a=application/json} is rejected.
+	 * <p>
+	 * Requiring {@code application/json} prevents browsers from sending cross-origin
+	 * JSON-RPC messages as CORS "simple requests" (e.g. with {@code text/plain}), which
+	 * would otherwise reach the server without a preflight.
+	 * @param contentType The {@code Content-Type} header value, may be {@code null}
+	 * @return {@code true} if the media type is {@code application/json}
+	 */
+	static boolean isJsonContentType(String contentType) {
+		if (contentType == null) {
+			return false;
+		}
+		int parametersStart = contentType.indexOf(';');
+		String mediaType = parametersStart == -1 ? contentType : contentType.substring(0, parametersStart);
+		return APPLICATION_JSON.equalsIgnoreCase(mediaType.trim());
+	}
+
+	/**
+	 * Writes a {@code 415 Unsupported Media Type} response with a JSON-RPC error body,
+	 * for requests whose {@code Content-Type} is not {@code application/json}, see
+	 * {@link #isJsonContentType(String)}.
+	 * @param response The HTTP servlet response
+	 * @param jsonMapper The JSON mapper used to serialize the error
+	 * @throws IOException If an I/O error occurs while writing the response
+	 */
+	static void rejectUnsupportedContentType(HttpServletResponse response, McpJsonMapper jsonMapper)
+			throws IOException {
+		McpError mcpError = McpError.builder(McpSchema.ErrorCodes.INVALID_REQUEST)
+			.message("Unsupported Media Type: Content-Type must be application/json")
+			.build();
+		response.setContentType(APPLICATION_JSON);
+		response.setCharacterEncoding(StandardCharsets.UTF_8.name());
+		response.setStatus(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE);
+		PrintWriter writer = response.getWriter();
+		writer.write(jsonMapper.writeValueAsString(mcpError));
+		writer.flush();
+	}
+
 	/**
 	 * Reads the request body, decoded using the request's character encoding (or UTF-8 if
 	 * not specified), while bounding the number of bytes read.

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java

@@ -377,6 +377,11 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
 			return;
 		}
 
+		if (!HttpServletRequestUtils.isJsonContentType(request.getContentType())) {
+			HttpServletRequestUtils.rejectUnsupportedContentType(response, this.jsonMapper);
+			return;
+		}
+
 		// Get the session ID from the request parameter
 		String sessionId = request.getParameter("sessionId");
 		if (sessionId == null) {

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStatelessServerTransport.java

@@ -179,6 +179,11 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
 			return;
 		}
 
+		if (!HttpServletRequestUtils.isJsonContentType(request.getContentType())) {
+			HttpServletRequestUtils.rejectUnsupportedContentType(response, this.jsonMapper);
+			return;
+		}
+
 		try {
 			String body = HttpServletRequestUtils.readBody(request, this.requestMaxSize);
 

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java

@@ -503,6 +503,11 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
 			badRequestErrors.add("application/json required in Accept header");
 		}
 
+		if (!HttpServletRequestUtils.isJsonContentType(request.getContentType())) {
+			HttpServletRequestUtils.rejectUnsupportedContentType(response, this.jsonMapper);
+			return;
+		}
+
 		McpTransportContext transportContext = this.contextExtractor.extract(request);
 
 		try {

mcp-core/src/test/java/io/modelcontextprotocol/server/transport/HttpServletRequestUtilsTests.java

@@ -12,6 +12,9 @@
 import jakarta.servlet.ServletInputStream;
 import jakarta.servlet.http.HttpServletRequest;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullAndEmptySource;
+import org.junit.jupiter.params.provider.ValueSource;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
@@ -100,6 +103,22 @@ void honorsRequestCharacterEncoding() throws Exception {
 		assertThat(body).isEqualTo("café");
 	}
 
+	@ParameterizedTest
+	@ValueSource(strings = { "application/json", "application/json; charset=utf-8", "application/json;charset=UTF-8",
+			"Application/JSON", " application/json ; charset=utf-8" })
+	void acceptsJsonContentType(String contentType) {
+		assertThat(HttpServletRequestUtils.isJsonContentType(contentType)).isTrue();
+	}
+
+	@ParameterizedTest
+	@NullAndEmptySource
+	@ValueSource(strings = { "text/plain", "text/plain;charset=UTF-8", "text/plain; a=application/json",
+			"application/x-www-form-urlencoded", "multipart/form-data", "application/json-seq", "application/jsonp",
+			"application/json, text/plain", "text/event-stream" })
+	void rejectsNonJsonContentType(String contentType) {
+		assertThat(HttpServletRequestUtils.isJsonContentType(contentType)).isFalse();
+	}
+
 	private static HttpServletRequest requestWithBody(String body, String characterEncoding) throws IOException {
 		HttpServletRequest request = mock(HttpServletRequest.class);
 		when(request.getInputStream()).thenReturn(servletInputStream(body.getBytes(StandardCharsets.UTF_8)));

mcp-test/src/test/java/io/modelcontextprotocol/server/HttpServletSseIntegrationTests.java

@@ -12,6 +12,9 @@
 import java.nio.charset.StandardCharsets;
 import java.time.Duration;
 import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.stream.Stream;
 
 import io.modelcontextprotocol.AbstractMcpClientServerIntegrationTests;
@@ -22,6 +25,7 @@
 import io.modelcontextprotocol.server.McpServer.SyncSpecification;
 import io.modelcontextprotocol.server.transport.HttpServletSseServerTransportProvider;
 import io.modelcontextprotocol.server.transport.TomcatTestUtil;
+import io.modelcontextprotocol.spec.McpSchema;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import org.apache.catalina.LifecycleException;
@@ -33,8 +37,12 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.ValueSource;
+import reactor.core.publisher.Mono;
 
+import static io.modelcontextprotocol.util.ToolsUtils.EMPTY_JSON_SCHEMA;
 import static org.assertj.core.api.Assertions.assertThat;
 
 @Timeout(15)
@@ -125,36 +133,8 @@ protected void prepareClients(int port, String mcpEndpoint) {
 	void rejectsWhenBodyBytesExceedLimitWithoutContentLengthHeader() throws Exception {
 		var httpClient = HttpClient.newHttpClient();
 
-		// Establish an SSE session to obtain a valid session ID
 		prepareAsyncServerBuilder().build();
-		var sseRequest = HttpRequest.newBuilder()
-			.uri(URI.create("http://localhost:" + PORT + CUSTOM_SSE_ENDPOINT))
-			.header("Accept", "text/event-stream")
-			.GET()
-			.build();
-		var sseResponseRef = new java.util.concurrent.atomic.AtomicReference<HttpResponse<java.io.InputStream>>();
-		var sessionIdFuture = new java.util.concurrent.CompletableFuture<String>();
-		httpClient.sendAsync(sseRequest, HttpResponse.BodyHandlers.ofInputStream()).thenAccept(response -> {
-			sseResponseRef.set(response);
-			try (var reader = new java.io.BufferedReader(
-					new java.io.InputStreamReader(response.body(), StandardCharsets.UTF_8))) {
-				String line;
-				while ((line = reader.readLine()) != null) {
-					if (line.startsWith("data:") && line.contains("sessionId=")) {
-						String data = line.substring("data:".length()).strip();
-						String sessionId = data.substring(data.indexOf("sessionId=") + "sessionId=".length());
-						sessionIdFuture.complete(sessionId);
-						return;
-					}
-				}
-				sessionIdFuture.completeExceptionally(new RuntimeException("sessionId not found in SSE stream"));
-				response.body().close();
-			}
-			catch (Exception e) {
-				sessionIdFuture.completeExceptionally(e);
-			}
-		});
-		String sessionId = sessionIdFuture.get(5, java.util.concurrent.TimeUnit.SECONDS);
+		String sessionId = openSseSession(httpClient);
 
 		// Send POST request with an over-sized body
 		byte[] oversizedBody = "a".repeat(MAX_REQUEST_SIZE + 1).getBytes(StandardCharsets.UTF_8);
@@ -194,6 +174,59 @@ public void cancel() {
 		assertThat(response.statusCode()).isEqualTo(HttpServletResponse.SC_REQUEST_ENTITY_TOO_LARGE);
 	}
 
+	@ParameterizedTest
+	@ValueSource(strings = { "text/plain;charset=UTF-8", "application/x-www-form-urlencoded", "multipart/form-data" })
+	void rejectsNonJsonContentType(String contentType) throws Exception {
+		var httpClient = HttpClient.newHttpClient();
+		var toolCalled = new AtomicBoolean();
+		prepareAsyncServerBuilder().capabilities(McpSchema.ServerCapabilities.builder().tools(true).build())
+			.tools(McpServerFeatures.AsyncToolSpecification.builder()
+				.tool(McpSchema.Tool.builder("tool1", EMPTY_JSON_SCHEMA).build())
+				.callHandler((exchange, request) -> {
+					toolCalled.set(true);
+					return Mono.just(McpSchema.CallToolResult.builder().build());
+				})
+				.build())
+			.build();
+		String sessionId = openSseSession(httpClient);
+
+		// CORS-safelisted content types can be sent cross-origin by a browser without a
+		// preflight, so they must be rejected before the message is handled
+		var request = HttpRequest.newBuilder()
+			.uri(URI.create("http://localhost:" + PORT + CUSTOM_MESSAGE_ENDPOINT + "?sessionId=" + sessionId))
+			.header("Content-Type", contentType)
+			.POST(HttpRequest.BodyPublishers.ofString("""
+					{"jsonrpc":"2.0","id":"call-1","method":"tools/call","params":{"name":"tool1","arguments":{}}}"""))
+			.build();
+
+		var response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());
+
+		assertThat(response.statusCode()).isEqualTo(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE);
+		assertThat(response.body()).contains("Unsupported Media Type: Content-Type must be application/json");
+		assertThat(toolCalled).isFalse();
+	}
+
+	/**
+	 * Opens an SSE connection and returns the session ID from the endpoint event. The
+	 * connection stays open, keeping the session alive, until the server closes it.
+	 */
+	private String openSseSession(HttpClient httpClient) throws Exception {
+		var sseRequest = HttpRequest.newBuilder()
+			.uri(URI.create("http://localhost:" + PORT + CUSTOM_SSE_ENDPOINT))
+			.header("Accept", "text/event-stream")
+			.GET()
+			.build();
+		var sessionIdFuture = new CompletableFuture<String>();
+		httpClient.sendAsync(sseRequest, HttpResponse.BodyHandlers.ofLines())
+			.thenAccept(response -> response.body().forEach(line -> {
+				int index = line.indexOf("sessionId=");
+				if (line.startsWith("data:") && index != -1) {
+					sessionIdFuture.complete(line.substring(index + "sessionId=".length()).strip());
+				}
+			}));
+		return sessionIdFuture.get(5, TimeUnit.SECONDS);
+	}
+
 	static McpTransportContextExtractor<HttpServletRequest> TEST_CONTEXT_EXTRACTOR = (r) -> McpTransportContext
 		.create(Map.of("important", "value"));
 

mcp-test/src/test/java/io/modelcontextprotocol/server/HttpServletStatelessIntegrationTests.java

@@ -13,6 +13,7 @@
 import java.time.Duration;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.BiFunction;
 import java.util.function.Function;
@@ -53,6 +54,8 @@
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.LoggerFactory;
 import reactor.core.publisher.Mono;
 import reactor.test.StepVerifier;
@@ -915,6 +918,39 @@ public void cancel() {
 		assertThat(response.statusCode()).isEqualTo(HttpServletResponse.SC_REQUEST_ENTITY_TOO_LARGE);
 	}
 
+	@ParameterizedTest
+	@ValueSource(strings = { "text/plain;charset=UTF-8", "application/x-www-form-urlencoded", "multipart/form-data" })
+	void rejectsNonJsonContentType(String contentType) throws Exception {
+		AtomicBoolean toolCalled = new AtomicBoolean();
+		McpServer.sync(mcpStatelessServerTransport)
+			.capabilities(ServerCapabilities.builder().tools(false).build())
+			.tools(McpStatelessServerFeatures.SyncToolSpecification.builder()
+				.tool(Tool.builder("tool1", EMPTY_JSON_SCHEMA).build())
+				.callHandler((transportContext, request) -> {
+					toolCalled.set(true);
+					return CallToolResult.builder().build();
+				})
+				.build())
+			.build();
+
+		// CORS-safelisted content types can be sent cross-origin by a browser without a
+		// preflight, so they must be rejected before the message is handled
+		var request = HttpRequest.newBuilder()
+			.uri(URI.create("http://localhost:" + PORT + CUSTOM_MESSAGE_ENDPOINT))
+			.header("Content-Type", contentType)
+			.header("Accept", APPLICATION_JSON + ", " + TEXT_EVENT_STREAM)
+			.POST(HttpRequest.BodyPublishers.ofString("""
+					{"jsonrpc":"2.0","id":"call-1","method":"tools/call","params":{"name":"tool1","arguments":{}}}"""))
+			.build();
+
+		var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
+
+		assertThat(response.statusCode()).isEqualTo(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE);
+		assertThatJson(response.body()).inPath("message")
+			.isEqualTo("Unsupported Media Type: Content-Type must be application/json");
+		assertThat(toolCalled).isFalse();
+	}
+
 	private double evaluateExpression(String expression) {
 		// Simple expression evaluator for testing
 		return switch (expression) {