modelcontextprotocol/ruby-sdk
Watch
1
0
Fork
You've already forked ruby-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add Accept header validation

Browse source 
- Set Accept header to request JSON or SSE responses
- Validate response Content-Type and raise error for non-JSON responses
- Add Accept header to test fixtures
- Use explicit hash syntax for Ruby 2.7 compatibility
This commit is contained in:
Keisuke Umegaki 2026-01-05 16:39:08 +09:00
commit ab8f53c5b7
No known key found for this signature in database
GPG key ID: 7FDBBAF53E29311B
2 changed files with 319 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

11
test/mcp/server/transports/streamable_http_notification_integration_test.rb
View file

@ -232,11 +232,20 @@ module MCP
private
def create_rack_request(method, path, headers, body = nil)
default_accept = case method
when "POST"
{ "HTTP_ACCEPT" => "application/json, text/event-stream" }
when "GET"
{ "HTTP_ACCEPT" => "text/event-stream" }
else
{}
end
env = {
"REQUEST_METHOD" => method,
"PATH_INFO" => path,
"rack.input" => StringIO.new(body.to_s),
}.merge(headers)
}.merge(default_accept, headers)
Rack::Request.new(env)
end

177
test/mcp/server/transports/streamable_http_transport_test.rb
View file

@ -573,6 +573,164 @@ module MCP
assert_equal "Method not allowed", body["error"]
end
test "POST request without Accept header returns 406" do
request = create_rack_request_without_accept(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "initialize", id: "123" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 406, response[0]
assert_equal({ "Content-Type" => "application/json" }, response[1])
body = JSON.parse(response[2][0])
assert_equal "Not Acceptable: Accept header must include application/json and text/event-stream",
body["error"]
end
test "POST request with Accept header missing text/event-stream returns 406" do
request = create_rack_request_without_accept(
"POST",
"/",
{
"CONTENT_TYPE" => "application/json",
"HTTP_ACCEPT" => "application/json",
},
{ jsonrpc: "2.0", method: "initialize", id: "123" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 406, response[0]
body = JSON.parse(response[2][0])
assert_equal "Not Acceptable: Accept header must include application/json and text/event-stream",
body["error"]
end
test "POST request with Accept header missing application/json returns 406" do
request = create_rack_request_without_accept(
"POST",
"/",
{
"CONTENT_TYPE" => "application/json",
"HTTP_ACCEPT" => "text/event-stream",
},
{ jsonrpc: "2.0", method: "initialize", id: "123" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 406, response[0]
body = JSON.parse(response[2][0])
assert_equal "Not Acceptable: Accept header must include application/json and text/event-stream",
body["error"]
end
test "POST request with valid Accept header succeeds" do
request = create_rack_request(
"POST",
"/",
{
"CONTENT_TYPE" => "application/json",
"HTTP_ACCEPT" => "application/json, text/event-stream",
},
{ jsonrpc: "2.0", method: "initialize", id: "123" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 200, response[0]
end
test "POST request with Accept header containing quality values succeeds" do
request = create_rack_request(
"POST",
"/",
{
"CONTENT_TYPE" => "application/json",
"HTTP_ACCEPT" => "application/json;q=0.9, text/event-stream;q=0.8",
},
{ jsonrpc: "2.0", method: "initialize", id: "123" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 200, response[0]
end
test "GET request without Accept header returns 406" do
init_request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "initialize", id: "123" }.to_json,
)
init_response = @transport.handle_request(init_request)
session_id = init_response[1]["Mcp-Session-Id"]
request = create_rack_request_without_accept(
"GET",
"/",
{ "HTTP_MCP_SESSION_ID" => session_id },
)
response = @transport.handle_request(request)
assert_equal 406, response[0]
body = JSON.parse(response[2][0])
assert_equal "Not Acceptable: Accept header must include text/event-stream", body["error"]
end
test "GET request with Accept header missing text/event-stream returns 406" do
init_request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "initialize", id: "123" }.to_json,
)
init_response = @transport.handle_request(init_request)
session_id = init_response[1]["Mcp-Session-Id"]
request = create_rack_request_without_accept(
"GET",
"/",
{
"HTTP_MCP_SESSION_ID" => session_id,
"HTTP_ACCEPT" => "application/json",
},
)
response = @transport.handle_request(request)
assert_equal 406, response[0]
body = JSON.parse(response[2][0])
assert_equal "Not Acceptable: Accept header must include text/event-stream", body["error"]
end
test "GET request with valid Accept header succeeds" do
init_request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "initialize", id: "123" }.to_json,
)
init_response = @transport.handle_request(init_request)
session_id = init_response[1]["Mcp-Session-Id"]
request = create_rack_request(
"GET",
"/",
{
"HTTP_MCP_SESSION_ID" => session_id,
"HTTP_ACCEPT" => "text/event-stream",
},
)
response = @transport.handle_request(request)
assert_equal 200, response[0]
assert_equal "text/event-stream", response[1]["Content-Type"]
end
test "stateless mode allows requests without session IDs, responding with no session ID" do
stateless_transport = StreamableHTTPTransport.new(@server, stateless: true)
@ -771,6 +929,25 @@ module MCP
private
def create_rack_request(method, path, headers, body = nil)
default_accept = case method
when "POST"
{ "HTTP_ACCEPT" => "application/json, text/event-stream" }
when "GET"
{ "HTTP_ACCEPT" => "text/event-stream" }
else
{}
end
env = {
"REQUEST_METHOD" => method,
"PATH_INFO" => path,
"rack.input" => StringIO.new(body.to_s),
}.merge(default_accept).merge(headers)
Rack::Request.new(env)
end
def create_rack_request_without_accept(method, path, headers, body = nil)
env = {
"REQUEST_METHOD" => method,
"PATH_INFO" => path,