modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

internal/docs: document UserID for session hijacking prevention (#697)

Browse source 
Update our Session Hijacking mitigation documentation to describe the
new TokenInfo.UserID field and how the streamable transport uses it to
bind sessions to users.

Fixes #571
This commit is contained in:
Robert Findley 2025-12-08 15:25:34 -05:00 • committed by GitHub
commit d1c06cb748
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 24 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
internal/docs/protocol.src.md
View file

@ -269,9 +269,18 @@ If you create your own with
If you are using Go 1.24 or above,
we recommend using [`crypto/rand.Text`](https://pkg.go.dev/crypto/rand#Text)
- _Binding session IDs to user information_. This is an application requirement, out of scope
for the SDK. You can create your own session IDs by setting
[`ServerOptions.GetSessionID`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/mcp#ServerOptions.GetSessionID).
- _Binding session IDs to user information_. The SDK supports this mitigation through
[`TokenInfo.UserID`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#TokenInfo.UserID).
When a [`TokenVerifier`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#TokenVerifier)
sets `UserID` on the returned `TokenInfo`, the streamable transport will:
1. Store the user ID when a new session is created.
2. Verify that subsequent requests to that session include a token with the same `UserID`.
3. Reject requests with a 403 Forbidden if the user ID doesn't match.
**Recommendation**: If your `TokenVerifier` can extract a user identifier from the token
(such as a `sub` claim in a JWT, or a user ID associated with an API key), set
`TokenInfo.UserID` to enable this protection. This prevents an attacker with a valid
token from hijacking another user's session by guessing or obtaining their session ID.
## Utilities