Merge pull request #274 from koic/reject_missing_session_id

Reject POST requests without session ID in stateful mode
2026-03-29 12:34:00 +09:00 · 2026-03-29 12:34:00 +09:00 · 8969edf4b9
commit 8969edf4b9
parent 0cc8a300b8 88d9bed69d
1 changed files with 63 additions and 3 deletions
--- a/lib/mcp/server/transports/streamable_http_transport.rb
+++ b/lib/mcp/server/transports/streamable_http_transport.rb
@ -120,10 +120,14 @@ module MCP

          if body["method"] == "initialize"
            handle_initialization(body_string, body)
-          elsif notification?(body) || response?(body)
-            handle_accepted
          else
-            handle_regular_request(body_string, session_id)
+            return missing_session_id_response if !@stateless && !session_id
+
+            if notification?(body) || response?(body)
+              handle_accepted
+            else
+              handle_regular_request(body_string, session_id)
+            end
          end
        rescue StandardError => e
          MCP.configuration.exception_reporter.call(e, { request: body_string })