Skip to content

fix(rmcp): reject duplicate SEP-2243 headers - #1274

Open
DaleSeo wants to merge 1 commit into
mainfrom
DaleSeo/streamable-http-server-duplicate-sep-2243-header
Open

DaleSeo wants to merge 1 commit into
mainfrom
DaleSeo/streamable-http-server-duplicate-sep-2243-header

Conversation

@DaleSeo

@DaleSeo DaleSeo commented Sep 14, 2026

Copy link
Copy Markdown
Member

Fixes #1272.

Motivation and Context

For SEP-2243, header validation used HeaderMap::get to read each header. That method returns only the first of several field lines with the same name. As a result, a request with two conflicting Mcp-Method values was validated against the first value, while the second was silently ignored. header_str now returns Result<Option<&str>, String> and rejects duplicate field lines. This handles Mcp-Method, Mcp-Name, and Mcp-Param-* in one place.

How Has This Been Tested?

Added tests

Breaking Changes

None

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

@github-actions github-actions Bot added T-core Core library changes T-transport Transport layer changes labels Sep 14, 2026
@DaleSeo
DaleSeo force-pushed the DaleSeo/streamable-http-server-duplicate-sep-2243-header branch from f985b6a to 6e33ca0 Compare September 15, 2026 15:23
@DaleSeo
DaleSeo marked this pull request as ready for review September 15, 2026 15:26
@DaleSeo
DaleSeo requested a review from a team as a code owner September 15, 2026 15:26
@DaleSeo DaleSeo self-assigned this Sep 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

T-core Core library changes T-transport Transport layer changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

streamable-http server: duplicate SEP-2243 headers silently resolve to the first value

1 participant