Skip to content

Duplicate access-control-allow-origin in response header #1688

@vran-dev

Description

@vran-dev

I’m integrating the GitHub MCP into an Electron app using @modelcontextprotocol/sdk. When the transport type is set to http, the request triggers a CORS exception.

Happy holidays and thanks for the great work you do all year—really appreciate it!

Request log

Request URL: https://api.githubcopilot.com/mcp/
Request Method: POST
Status Code: 200 OK

access-control-allow-headers: Content-Type, Authorization, X-MCP-Readonly, X-MCP-Toolsets, Mcp-Session-Id
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-allow-origin: *
date:Fri, 26 Dec 2025 03:42:49 GMT
mcp-session-id:5187b67a-987f-4bcb-b1f2-bee4da140384
x-github-backend:Kubernetes
x-github-request-id:34FF:57BDD:69DD0:92447:694E0439

CURL reproduce

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions