modelcontextprotocol/ruby-sdk
Watch
1
0
Fork
You've already forked ruby-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #274 from koic/reject_missing_session_id

Browse source 
Reject POST requests without session ID in stateful mode
This commit is contained in:
Koichi ITO 2026-03-29 12:34:00 +09:00 • committed by GitHub
commit 8969edf4b9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 63 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/mcp/server/transports/streamable_http_transport.rb
View file

@ -120,10 +120,14 @@ module MCP
if body["method"] == "initialize"
handle_initialization(body_string, body)
elsif notification?(body) || response?(body)
handle_accepted
else
handle_regular_request(body_string, session_id)
return missing_session_id_response if !@stateless && !session_id
if notification?(body) || response?(body)
handle_accepted
else
handle_regular_request(body_string, session_id)
end
end
rescue StandardError => e
MCP.configuration.exception_reporter.call(e, { request: body_string })

56
test/mcp/server/transports/streamable_http_transport_test.rb
View file

@ -272,6 +272,62 @@ module MCP
assert_equal "Missing session ID", body["error"]
end
test "rejects POST request without session ID in stateful mode" do
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "ping", id: "1" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 400, response[0]
body = JSON.parse(response[2][0])
assert_equal "Missing session ID", body["error"]
end
test "rejects notification without session ID in stateful mode" do
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "notifications/initialized" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 400, response[0]
body = JSON.parse(response[2][0])
assert_equal "Missing session ID", body["error"]
end
test "rejects response without session ID in stateful mode" do
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", id: "1", result: {} }.to_json,
)
response = @transport.handle_request(request)
assert_equal 400, response[0]
body = JSON.parse(response[2][0])
assert_equal "Missing session ID", body["error"]
end
test "allows POST request without session ID in stateless mode" do
stateless_transport = StreamableHTTPTransport.new(@server, stateless: true)
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "ping", id: "1" }.to_json,
)
response = stateless_transport.handle_request(request)
assert_equal 200, response[0]
end
test "rejects duplicate SSE connection with 409" do
# Create a session
init_request = create_rack_request(