Tell clients that they are allowed to use Mcp-Session-Id header (#165)

Nyholm · web-flow · commit 48634bd8c00b · 2025-11-30T11:00:51.000+01:00
diff --git a/src/Server/Transport/StreamableHttpTransport.php b/src/Server/Transport/StreamableHttpTransport.php
@@ -57,6 +57,7 @@ public function __construct(
             'Access-Control-Allow-Origin' => '*',
             'Access-Control-Allow-Methods' => 'GET, POST, DELETE, OPTIONS',
             'Access-Control-Allow-Headers' => 'Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, Authorization, Accept',
+            'Access-Control-Expose-Headers' => 'Mcp-Session-Id',
         ], $corsHeaders);
     }
 

Original file line number	Diff line number	Diff line change
`@@ -57,6 +57,7 @@ public function __construct(`
`57`	`57`	`'Access-Control-Allow-Origin' => '*',`
`58`	`58`	`'Access-Control-Allow-Methods' => 'GET, POST, DELETE, OPTIONS',`
`59`	`59`	`'Access-Control-Allow-Headers' => 'Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, Authorization, Accept',`
	`60`	`+ 'Access-Control-Expose-Headers' => 'Mcp-Session-Id',`
`60`	`61`	`], $corsHeaders);`
`61`	`62`	`}`
`62`	`63`