fix(examples): return 404 for unknown session IDs, 400 for missing#1770
fix(examples): return 404 for unknown session IDs, 400 for missing#1770felixweinberger wants to merge 1 commit intomainfrom
Conversation
Per spec, clients interpret 404 as "start a new session" — the examples were returning 400 for both missing and unknown session IDs, which breaks client recovery logic. Split the check so unknown IDs return 404. Fixes #389
🦋 Changeset detectedLatest commit: 15e5b36 The changes in this PR will be included in the next version bump. This PR includes changesets to release 0 packagesWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@modelcontextprotocol/client
@modelcontextprotocol/server
@modelcontextprotocol/express
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM, straightforward mechanical split of session ID checks across example and conformance test servers.
Extended reasoning...
Overview
This PR modifies 7 example server files and 2 conformance test server files to split the combined session ID check into two separate branches: 400 for missing session ID, 404 for unknown session ID.
Security risks
None. Changes are in example and test servers only.
Level of scrutiny
Low. Mechanical, repetitive change to example and test code, not library code.
Other factors
Consolidates 4 previous PRs. Pattern is consistent across all files. No bugs found.
1 participant
Splits the session ID check in example servers so unknown session IDs return 404 (signaling clients to start a new session) while missing session IDs return 400.
Motivation and Context
Per spec, clients interpret 404 on a request with
Mcp-Session-Idas "start a new session." The examples were returning 400 for both cases, breaking client recovery logic. Issue was reported by the VS Code team.Fixes #389
How Has This Been Tested?
pnpm check:allpasses. Covers all example servers plus conformance test servers.Breaking Changes
None — examples only.
Types of changes
Checklist
Additional context
Supersedes #1331, #1560, #1678, #1707 — thanks @lraveri and @owendevereaux for the earlier work. This consolidates on a tighter diff and covers
authTestServer.tsandjsonResponseStreamableHttp.tswhich the previous PRs missed.