modelcontextprotocol/ruby-sdk
Watch
1
0
Fork
You've already forked ruby-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reject notifications carrying an unknown or expired session

Browse source 
## Motivation and Context

In `StreamableHTTPTransport#handle_post`, the response and regular-request branches reject
a message whose session no longer exists (the response branch via `session_exists?`,
the regular path via `validate_and_touch_session`), but the notification branch dispatched unconditionally.
A notification carrying a present-but-unknown (or expired-but-not-yet-reaped) `Mcp-Session-Id`
therefore passed the `missing_session_id` gate and the ownership gate (which returns true
when the session does not exist) and reached `dispatch_notification` with no session,
running against the shared `Server` instead of a live `ServerSession`. With the default no-op notification
handlers this had no visible effect, but a custom notification handler would then run without
a live session behind it.

`handle_post` now checks `session_active?` in the notification branch, mirroring the other two branches.
`session_active?` rejects an unknown or expired session (evicting the expired one) without extending its lifetime,
so a stale session ID yields `404 Session not found` and a live session is dispatched exactly as before.

## How Has This Been Tested?

New tests in `test/mcp/server/transports/streamable_http_transport_test.rb` assert that
a notification with an unknown session ID is rejected with `404 Session not found`
and that a notification carrying a live session ID is still accepted with `202`.
The new rejection test fails against the previous code (it returned `202`) and passes now.

## Breaking Changes

None for a conforming client: a client that has completed `initialize` sends its notifications with
the live session ID and is unaffected. Only a notification bearing an unknown or expired session ID,
previously accepted with `202`, now receives `404 Session not found`.
This commit is contained in:
Koichi ITO 2026-07-10 01:01:15 +09:00
commit 6236ea1b34
1 changed files with 39 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/mcp/server/transports/streamable_http_transport.rb
View file

@ -517,6 +517,11 @@ module MCP
end
if notification?(body)
# Reject a notification carrying an unknown or expired session ID instead of
# dispatching it against the shared `Server`. Mirrors the response and regular-request
# branches; without it a custom notification handler could run without a live session.
return session_not_found_response if !@stateless && !session_active?(session_id)
dispatch_notification(body_string, session_id)
handle_accepted
elsif response?(body)