modelcontextprotocol/ruby-sdk
Watch
1
0
Fork
You've already forked ruby-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reject POST requests without session ID in stateful mode

Browse source 
Per the MCP specification (Streamable HTTP > Session Management):

> Servers that require a session ID SHOULD respond to requests without an `Mcp-Session-Id` header
> (other than initialization) with HTTP 400 Bad Request.

https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#session-management

Previously, non-initialize POST requests without `Mcp-Session-Id` in stateful mode were processed
with HTTP 200 (for regular requests) or HTTP 202 (for notifications/responses).

This change adds an explicit check in `handle_post` to return HTTP 400 Bad Request when the session
ID is missing in stateful mode for all non-initialize requests, aligning with the specification.
This commit is contained in:
Koichi ITO 2026-03-28 02:45:58 +09:00
commit 88d9bed69d
2 changed files with 63 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/mcp/server/transports/streamable_http_transport.rb
View file

@ -120,10 +120,14 @@ module MCP
if body["method"] == "initialize"
handle_initialization(body_string, body)
elsif notification?(body) || response?(body)
handle_accepted
else
handle_regular_request(body_string, session_id)
return missing_session_id_response if !@stateless && !session_id
if notification?(body) || response?(body)
handle_accepted
else
handle_regular_request(body_string, session_id)
end
end
rescue StandardError => e
MCP.configuration.exception_reporter.call(e, { request: body_string })

56
test/mcp/server/transports/streamable_http_transport_test.rb
View file

@ -272,6 +272,62 @@ module MCP
assert_equal "Missing session ID", body["error"]
end
test "rejects POST request without session ID in stateful mode" do
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "ping", id: "1" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 400, response[0]
body = JSON.parse(response[2][0])
assert_equal "Missing session ID", body["error"]
end
test "rejects notification without session ID in stateful mode" do
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "notifications/initialized" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 400, response[0]
body = JSON.parse(response[2][0])
assert_equal "Missing session ID", body["error"]
end
test "rejects response without session ID in stateful mode" do
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", id: "1", result: {} }.to_json,
)
response = @transport.handle_request(request)
assert_equal 400, response[0]
body = JSON.parse(response[2][0])
assert_equal "Missing session ID", body["error"]
end
test "allows POST request without session ID in stateless mode" do
stateless_transport = StreamableHTTPTransport.new(@server, stateless: true)
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "ping", id: "1" }.to_json,
)
response = stateless_transport.handle_request(request)
assert_equal 200, response[0]
end
test "rejects duplicate SSE connection with 409" do
# Create a session
init_request = create_rack_request(