Repository navigation
Streamable HTTP: rejected GET requests get 200 OK #1036
Description
mcpStreamableHttp serves GET through Ktor's sse { }, which sends 200 OK with Content-Type: text/event-stream before the handler runs. A rejection decided in the handler can't change the status any more, so the client gets 200 and an empty stream that closes immediately:
| GET request | Expected | Actual |
|---|---|---|
No Mcp-Session-Id |
400 | 200 |
| Unknown or terminated session | 404 | 200 |
Unsupported MCP-Protocol-Version |
400 | 200 |
Accept without text/event-stream |
406 | 200 |
The spec requires 404 for a terminated session and 400 for an unsupported protocol version, and clients rely on that 404 to start a new session. POST and DELETE are not affected.
Fix: validate GET requests before the SSE upgrade (for example, in a route interceptor) and finish the call there.
#1032 fixes the first two rows.
Activity