modelcontextprotocol/ruby-sdk
Watch
1
0
Fork
You've already forked ruby-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #455 from koic/reject_notifications_for_unknown_sessions

Browse source 
Reject notifications carrying an unknown or expired session
This commit is contained in:
Koichi ITO 2026-07-15 12:01:42 +09:00 • committed by GitHub
commit 5425c9c4ee
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 39 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/mcp/server/transports/streamable_http_transport.rb
View file

@ -517,6 +517,11 @@ module MCP
end
if notification?(body)
# Reject a notification carrying an unknown or expired session ID instead of
# dispatching it against the shared `Server`. Mirrors the response and regular-request
# branches; without it a custom notification handler could run without a live session.
return session_not_found_response if !@stateless && !session_active?(session_id)
dispatch_notification(body_string, session_id)
handle_accepted
elsif response?(body)

34
test/mcp/server/transports/streamable_http_transport_test.rb
View file

@ -525,6 +525,40 @@ module MCP
assert_equal "Missing session ID", body["error"]["message"]
end
test "rejects notification with an unknown session ID in stateful mode" do
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json", "HTTP_MCP_SESSION_ID" => "does-not-exist" },
{ jsonrpc: "2.0", method: "notifications/initialized" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 404, response[0]
body = JSON.parse(response[2][0])
assert_equal "Session not found", body["error"]["message"]
end
test "accepts a notification carrying a live session ID in stateful mode" do
init_request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "initialize", id: "init", params: initialize_params }.to_json,
)
session_id = @transport.handle_request(init_request)[1]["Mcp-Session-Id"]
notification = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json", "HTTP_MCP_SESSION_ID" => session_id },
{ jsonrpc: "2.0", method: "notifications/initialized" }.to_json,
)
response = @transport.handle_request(notification)
assert_equal 202, response[0]
end
test "rejects response without session ID in stateful mode" do
request = create_rack_request(
"POST",