Title: [v1.x] Bind transport sessions to the authenticated principal by maxisbey · Pull Request #2719 · modelcontextprotocol/python-sdk · GitHub
Open Graph Title: [v1.x] Bind transport sessions to the authenticated principal by maxisbey · Pull Request #2719 · modelcontextprotocol/python-sdk
X Title: [v1.x] Bind transport sessions to the authenticated principal by maxisbey · Pull Request #2719 · modelcontextprotocol/python-sdk
Description: v1.x backport of #2718. Summary The Streamable HTTP and SSE transports now record the principal that created each session — the OAuth client together with the issuer and subject when the token verifier supplies them — and serve subsequent requests for that session only when they present the same principal. Requests presenting a different principal receive the same 404 response as for an unknown session ID. SSE session entries are also removed when the connection ends rather than retained for the lifetime of the transport. Differences from #2718 main has a strict-coverage gate that the in-process SSE tests bring into play, so #2718 also adds an SSE round-trip test, edge-case tests, tests/server/test_transport_security.py, and removes no cover pragmas. v1.x has no such gate, so this PR carries only the credential-binding tests. Behaviour Same as #2718. Breaking changes None for default deployments. A hand-rolled SSE setup that applies BearerAuthBackend only to the POST route and not the GET route would now reject every message; FastMCP applies auth at the app level and is unaffected. AI Disclaimer
Open Graph Description: v1.x backport of #2718. Summary The Streamable HTTP and SSE transports now record the principal that created each session — the OAuth client together with the issuer and subject when the token veri...
X Description: v1.x backport of #2718. Summary The Streamable HTTP and SSE transports now record the principal that created each session — the OAuth client together with the issuer and subject when the token veri...
Opengraph URL: https://github.com/modelcontextprotocol/python-sdk/pull/2719
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:887e2d54-cac4-ed6a-2581-18a06fd5c762 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | 9510:30A11A:1BE4CD4:250C9B9:6A5AE54A |
| html-safe-nonce | ec0af77c2aa51eb77be0139f9a6fca5483a8df5eec446c054632e95e1c919b13 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5NTEwOjMwQTExQToxQkU0Q0Q0OjI1MEM5Qjk6NkE1QUU1NEEiLCJ2aXNpdG9yX2lkIjoiNjkxMTAxNTc0NTg4MDc3ODA1OCIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | 8c9c84ef9b5aa55c02d6d1f73506313d46c42bb35488dc62e4db38d54a3ab521 |
| hovercard-subject-tag | pull_request:3770056810 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/modelcontextprotocol/python-sdk/pull/2719/files |
| twitter:image | https://avatars.githubusercontent.com/u/224885523?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/224885523?s=400&v=4 |
| og:image:alt | v1.x backport of #2718. Summary The Streamable HTTP and SSE transports now record the principal that created each session — the OAuth client together with the issuer and subject when the token veri... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 5290d7e14309ad1e76106a9c4237bd1041517e83ea182c8ab756752cb0c6940b |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/modelcontextprotocol/python-sdk git https://github.com/modelcontextprotocol/python-sdk.git |
| octolytics-dimension-user_id | 182288589 |
| octolytics-dimension-user_login | modelcontextprotocol |
| octolytics-dimension-repository_id | 862584018 |
| octolytics-dimension-repository_nwo | modelcontextprotocol/python-sdk |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 862584018 |
| octolytics-dimension-repository_network_root_nwo | modelcontextprotocol/python-sdk |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 9c975978430e9ad293956f2bbdaf153b1bd84a99 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width