René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"StreamableHTTPSessionManager returns 400 instead of 404 for unknown session ID","articleBody":"## Description\n\n`StreamableHTTPSessionManager._handle_stateful_request()` returns HTTP 400 Bad Request when a session ID is provided but not found in the server instances. According to the MCP spec, this should be HTTP 404 Not Found.\n\n## Spec Reference\n\nFrom the [Streamable HTTP transport spec](https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#session-management):\n\n\u003e Servers that require a session ID SHOULD respond to requests without an `Mcp-Session-Id` header (other than initialization) with **HTTP 400 Bad Request**.\n\n\u003e The server MAY terminate the session at any time, after which it MUST respond to requests containing that session ID with **HTTP 404 Not Found**.\n\n\u003e When a client receives HTTP 404 in response to a request containing an `Mcp-Session-Id`, it MUST start a new session by sending a new `InitializeRequest` without a session ID attached.\n\n## Current Behavior\n\nIn `src/mcp/server/streamable_http_manager.py`, the `_handle_stateful_request` method:\n\n```python\nif request_mcp_session_id is not None and request_mcp_session_id in self._server_instances:\n    # Handle existing session\n    ...\nelif request_mcp_session_id is None:\n    # Create new session\n    ...\nelse:\n    # Session ID provided but not found\n    response = Response(\n        \"Bad Request: No valid session ID provided\",\n        status_code=HTTPStatus.BAD_REQUEST,  # ← Should be NOT_FOUND (404)\n    )\n```\n\n## Expected Behavior\n\nThe `else` branch should return 404 Not Found:\n\n```python\nelse:\n    response = Response(\n        \"Not Found: Session not found\",\n        status_code=HTTPStatus.NOT_FOUND,\n    )\n```\n\n## Why This Matters\n\nThe distinction matters for client behavior:\n- **400** indicates a malformed request - clients may retry or report an error\n- **404** indicates the session doesn't exist - clients know to re-initialize\n\nThe transport layer (`streamable_http.py`) correctly implements this in `_validate_session()`, but the manager layer has its own session lookup that doesn't follow the same pattern.\n\n## Note\n\nThe TypeScript SDK's `StreamableHTTPServerTransport` correctly returns 404 for session mismatch in its `validateSession` method.","author":{"url":"https://github.com/johnw188","@type":"Person","name":"johnw188"},"datePublished":"2025-12-05T14:10:38.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/1727/python-sdk/issues/1727"}