modelcontextprotocol/csharp-sdk
Watch
1
0
Fork
You've already forked csharp-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Validate user on Streamable HTTP session DELETE (#1604)

Browse source
This commit is contained in:
Stephen Halter 2026-05-28 12:50:25 -07:00 • committed by GitHub
commit a87518cf44
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 88 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/ModelContextProtocol.AspNetCore/StreamableHttpHandler.cs
View file

@ -218,7 +218,20 @@ internal sealed class StreamableHttpHandler(
}
var sessionId = context.Request.Headers[McpSessionIdHeaderName].ToString();
if (sessionManager.TryRemove(sessionId, out var session))
if (string.IsNullOrEmpty(sessionId) || !sessionManager.TryGetValue(sessionId, out var session))
{
return;
}
if (!session.HasSameUserId(context.User))
{
await WriteJsonRpcErrorAsync(context,
"Forbidden: The currently authenticated user does not match the user who initiated the session.",
StatusCodes.Status403Forbidden);
return;
}
if (sessionManager.TryRemove(sessionId, out session))
{
await session.DisposeAsync();
}