Update readme file to include a tip to allow mcp-session-id in CORS when using StreamableHTTP

[Achintha444]

Motivation and Context

I think this should be included in the main README, as it’s a unique case and developers might waste a lot of time trying to solve this small issue.

How Has This Been Tested?

N/A

Breaking Changes

N/A

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

• Bad Request: Server not initialized - for state and stateless StreamableHTTPServerTransport #412
• Bad Request: Server not initialized - for state and stateless StreamableHTTPServerTransport #412 (comment)

[ihrpr]

Thank you for contributing to Typescript SDK!

While the CORS issue is real and documented guidance is needed, the current example has security concerns. The example uses origin: '*' which is unsafe for production.
Please could you update to use a secure CORS example with specific origins instead of wildcard

[Achintha444]

Thank you for contributing to Typescript SDK!

While the CORS issue is real and documented guidance is needed, the current example has security concerns. The example uses origin: '*' which is unsafe for production. Please could you update to use a secure CORS example with specific origins instead of wildcard

Thank you for pointing that out. I completely understand your point. I added that as a quick example, but you're right about the security risks. I'll update it to use a more secure CORS configuration with specific origins instead of a wildcard.

[Achintha444]

Thank you for contributing to Typescript SDK!

While the CORS issue is real and documented guidance is needed, the current example has security concerns. The example uses origin: '*' which is unsafe for production. Please could you update to use a secure CORS example with specific origins instead of wildcard

PR updated

[ihrpr]

Thank you!