modelcontextprotocol/php-sdk
Watch
1
0
Fork
You've already forked php-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

[Server] Reject malformed MCP session ID headers (#384)

Browse source 
* [Server] Reject malformed MCP session ID headers

* [Server] Narrow invalid session ID exception handling

* [Server] Keep UUID catch compatible with supported Symfony
This commit is contained in:
King Star 2026-07-15 06:20:43 +08:00 • committed by GitHub
commit d187002d87
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 46 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/Server/Transport/StreamableHttpTransport.php
View file

@ -343,8 +343,19 @@ class StreamableHttpTransport extends BaseTransport
private function handleRequest(ServerRequestInterface $request): ResponseInterface
{
$this->request = $request;
$sessionIdString = $request->getHeaderLine(self::SESSION_HEADER);
$this->sessionId = $sessionIdString ? Uuid::fromString($sessionIdString) : null;
$sessionIdHeaders = $request->getHeader(self::SESSION_HEADER);
if (\count($sessionIdHeaders) > 1) {
return $this->createErrorResponse(Error::forInvalidRequest(self::SESSION_HEADER.' header must not be repeated.'), 400);
}
$sessionIdString = $sessionIdHeaders[0] ?? '';
try {
$this->sessionId = $sessionIdString ? Uuid::fromString($sessionIdString) : null;
// Symfony UID 5.4/6.4 throw the global parent; newer versions throw a namespaced subclass.
} catch (\InvalidArgumentException) {
return $this->createErrorResponse(Error::forInvalidRequest(self::SESSION_HEADER.' header must be a valid UUID.'), 400);
}
return match ($request->getMethod()) {
'OPTIONS' => $this->handleOptionsRequest(),