Legacy SSE GET drops headers set by hooks (CORS, security headers)
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
- Domain
- backend
Research direction
Read the legacy SSE GET /mcp handler and compare its hijacked response with request-stream.ts and subscriptions.ts, which already copy reply headers. Reproduce with an onRequest hook that sets the two CORS headers, then check the normal and error paths. Done when both paths preserve hook headers and the repro confirms the SSE response includes them.
Written by the indexing model from the issue text.
Description
Summary
The legacy SSE GET /mcp response leaves out headers that hooks set on the reply, such as CORS and security headers. A cross-origin browser client therefore cannot open the stream or read Mcp-Session-Id.
Cause
The handler calls reply.hijack() and then raw.writeHead(200) without copying reply.getHeaders(). The 2026-07-28 streams copy them (request-stream.ts, subscriptions.ts).
Repro
Add an onRequest hook that sets access-control-allow-origin and access-control-expose-headers.
- POST keeps both headers.
- The SSE GET returns 200 with neither.
Suggested fix
Read reply.getHeaders() before calling hijack() and pass them to raw.writeHead. Apply the same fix to the hijacked error path.
🤖 Generated with Claude Code
- Dominant language
- TypeScript
- Stars
- 58
- Forks
- 15
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 53
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from platformatic/mcp
-
README: the Resource URI Schemas example's file://documents/* pattern only matches that literal URIOpen
Difficulty 1/5 Under an hour Newbie friendliness 88/100
platformatic/mcp#361 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
platformatic/mcp#360 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
platformatic/mcp#359 ·
Maintainers usually reply within 1 day
-
Legacy POST accepts messages that are not JSON-RPC 2.0Possibly taken @mcollina claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
platformatic/mcp#344 ·
Maintainers usually reply within 1 day
-
Legacy SSE GET ignores resolveAuthorizationContext expiresAtPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
platformatic/mcp#336 ·
Maintainers usually reply within 1 day
All issues in platformatic/mcp
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
paperclipai/paperclip#17151 ·
Maintainers usually reply within 1 day
-
needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
AgoraIO-Extensions/agent-infra#3159 ·
Maintainers usually reply within 1 day
-
blocklist addition
Difficulty 1/5 Under an hour Newbie friendliness 66/100
MetaMask/eth-phishing-detect#304596 ·
Maintainers usually reply within 1 day
-
friction
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
kentcdodds/kody#4142 ·
-
[Bug] Statistics | Task statistics are always empty on MikroORM with MySQL or SQLitePossibly taken @NdekoCode claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
ever-co/ever-gauzy#11214 ·
Maintainers usually reply within 1 day