From d251800d19f7cd8e6305f35a348817c7f604687d Mon Sep 17 00:00:00 2001 From: Nate Usher Date: Mon, 28 Jul 2025 11:41:17 -0700 Subject: [PATCH] fix: return a 405 for GET and DELETE if stateful_mode=false (#331) --- .../src/transport/streamable_http_server/tower.rs | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/crates/rmcp/src/transport/streamable_http_server/tower.rs b/crates/rmcp/src/transport/streamable_http_server/tower.rs index 0ed0858..90473b3 100644 --- a/crates/rmcp/src/transport/streamable_http_server/tower.rs +++ b/crates/rmcp/src/transport/streamable_http_server/tower.rs @@ -111,15 +111,20 @@ where B::Error: Display, { let method = request.method().clone(); - let result = match method { - Method::GET => self.handle_get(request).await, - Method::POST => self.handle_post(request).await, - Method::DELETE => self.handle_delete(request).await, + let allowed_methods = match self.config.stateful_mode { + true => "GET, POST, DELETE", + false => "POST", + }; + let result = match (method, self.config.stateful_mode) { + (Method::POST, _) => self.handle_post(request).await, + // if we're not in stateful mode, we don't support GET or DELETE because there is no session + (Method::GET, true) => self.handle_get(request).await, + (Method::DELETE, true) => self.handle_delete(request).await, _ => { // Handle other methods or return an error let response = Response::builder() .status(http::StatusCode::METHOD_NOT_ALLOWED) - .header(ALLOW, "GET, POST, DELETE") + .header(ALLOW, allowed_methods) .body(Full::new(Bytes::from("Method Not Allowed")).boxed()) .expect("valid response"); return response;