fix(streamable-http): also reject PUT/PATCH/OPTIONS/HEAD without session-id

cubic-dev-ai flagged that the previous fix only short-circuited GET and
DELETE — the other non-POST methods still entered the "new session"
branch, allocated a transport, and spawned run_server before the
transport-layer 405 was returned. Same leak, different method.

This commit extends the check to every non-POST method. GET/DELETE
remain 400 "Missing session ID" (protocol-valid when a session exists,
so the caller may have simply forgotten the header). Everything else
becomes 405 "Method Not Allowed" at the manager layer — matching the
old transport-layer 405 exactly, minus the leaked session and task.

Also applies the repository's ruff format to the test module, which
the pre-commit hook flagged on CI, and switches the regression test's
assertions to use the parametrized ``expected_status`` /
``expected_message_substring`` values so the new PUT/PATCH/OPTIONS/HEAD
rows can piggy-back on the same test body.

Author: raphaelOhana

src/mcp/server/streamable_http_manager.py

@@ -283,31 +283,43 @@ async def _handle_stateful_request(
         if request_mcp_session_id is None:
             # Only POST may initialize a new session (per MCP spec: a session is
             # opened by the response to the ``initialize`` JSON-RPC request,
-            # which is always a POST). GET and DELETE without a session-id are
-            # protocol errors and must be rejected here — the transport-layer
-            # rejection happens too late to matter: by the time
-            # `StreamableHTTPServerTransport.handle_request()` sees the request,
-            # the session has already been allocated in `_server_instances`
-            # AND a background `run_server` task has been spawned, waiting on a
+            # which is always a POST). Any non-POST request without a session-id
+            # is a protocol error and must be rejected here — the transport-layer
+            # rejection happens too late: by the time
+            # ``StreamableHTTPServerTransport.handle_request()`` sees the request,
+            # a session has already been allocated in ``_server_instances`` and
+            # a background ``run_server`` task has been spawned waiting on a
             # stream that will never receive anything. Both leak forever unless
-            # `session_idle_timeout` is set (which is opt-in and off by default).
-            # Other unsupported methods (PUT/PATCH/OPTIONS/...) are intentionally
-            # let through to the existing ``_handle_unsupported_request`` path,
-            # which returns 405 — preserved for API stability.
-            if request.method in ("GET", "DELETE"):
-                error_response = JSONRPCError(
-                    jsonrpc="2.0",
-                    id="server-error",
-                    error=ErrorData(
-                        code=INVALID_REQUEST,
-                        message="Bad Request: Missing session ID",
-                    ),
-                )
-                response = Response(
-                    content=error_response.model_dump_json(by_alias=True, exclude_none=True),
-                    status_code=400,
-                    media_type="application/json",
-                )
+            # ``session_idle_timeout`` is set (opt-in, off by default). Rejecting
+            # here also holds for PUT/PATCH/OPTIONS/HEAD — the transport would
+            # answer 405 to those, but only after the leaky allocation.
+            if request.method != "POST":
+                # GET/DELETE are protocol-valid methods when a session exists,
+                # so the correct response for a missing session is 400 — matching
+                # the transport's existing "Missing session ID" wording. Anything
+                # else is a genuinely unsupported method, so 405 is more accurate.
+                if request.method in ("GET", "DELETE"):
+                    error_body = JSONRPCError(
+                        jsonrpc="2.0",
+                        id="server-error",
+                        error=ErrorData(code=INVALID_REQUEST, message="Bad Request: Missing session ID"),
+                    )
+                    response = Response(
+                        content=error_body.model_dump_json(by_alias=True, exclude_none=True),
+                        status_code=400,
+                        media_type="application/json",
+                    )
+                else:
+                    error_body = JSONRPCError(
+                        jsonrpc="2.0",
+                        id="server-error",
+                        error=ErrorData(code=INVALID_REQUEST, message=f"Method Not Allowed ({request.method})"),
+                    )
+                    response = Response(
+                        content=error_body.model_dump_json(by_alias=True, exclude_none=True),
+                        status_code=405,
+                        media_type="application/json",
+                    )
                 await response(scope, receive, send)
                 return
 

tests/server/test_streamable_http_manager.py

@@ -384,18 +384,35 @@ async def capture_send(message: Message):
 
 
 @pytest.mark.anyio
-@pytest.mark.parametrize("method", ["GET", "DELETE"])
-async def test_non_post_without_session_id_does_not_allocate_session(method: str):
-    """Regression test: GET/DELETE without a session-id must return 400 without
-    allocating a session or spawning a background task.
-
-    Before this fix, any request without a session id — including GET/DELETE —
-    entered the "new session" branch of the manager, created a transport,
-    registered it in ``_server_instances``, and launched a ``run_server`` task
-    that would wait forever for messages that never come. The transport-level
-    validation then rejected the request (with 400 or 406), but the allocated
-    session + task were leaked. Under a Docker healthcheck polling /mcp every
-    30 seconds this accumulated ~2 sessions/min indefinitely (~1 GiB/week).
+@pytest.mark.parametrize(
+    ("method", "expected_status", "expected_message_substring"),
+    [
+        ("GET", 400, "Missing session ID"),
+        ("DELETE", 400, "Missing session ID"),
+        ("PUT", 405, "Method Not Allowed"),
+        ("PATCH", 405, "Method Not Allowed"),
+        ("OPTIONS", 405, "Method Not Allowed"),
+        ("HEAD", 405, "Method Not Allowed"),
+    ],
+)
+async def test_non_post_without_session_id_does_not_allocate_session(
+    method: str, expected_status: int, expected_message_substring: str
+):
+    """Regression test: no non-POST method without a session-id may allocate a
+    session or spawn a background task.
+
+    Before this fix, any request without a session id — including GET/DELETE
+    (per this bug report) but also PUT/PATCH/OPTIONS/HEAD — entered the
+    "new session" branch of the manager, created a transport, registered it
+    in ``_server_instances``, and launched a ``run_server`` task that would
+    wait forever for messages that never come. The transport-level validation
+    then returned 400/406/405, but the allocated session + task were leaked.
+    Under a Docker healthcheck polling /mcp every 30 seconds this accumulated
+    ~2 sessions/min indefinitely (~1 GiB/week).
+
+    GET/DELETE are protocol-valid methods when a session exists, so they get
+    ``400 "Missing session ID"``. Other methods are genuinely unsupported on
+    the MCP endpoint, so they get ``405 "Method Not Allowed"``.
     """
     app = Server("test-non-post-no-session")
     manager = StreamableHTTPSessionManager(app=app)
@@ -445,12 +462,12 @@ async def mock_receive():  # pragma: no cover
             None,
         )
         assert response_start is not None, "Should have sent a response"
-        assert response_start["status"] == 400
+        assert response_start["status"] == expected_status
 
         error_data = json.loads(response_body)
         assert error_data["jsonrpc"] == "2.0"
         assert error_data["error"]["code"] == INVALID_REQUEST
-        assert "Missing session ID" in error_data["error"]["message"]
+        assert expected_message_substring in error_data["error"]["message"]
 
 
 @pytest.mark.anyio
@@ -466,9 +483,7 @@ async def test_bad_host_header_rejected_before_session_allocation():
     app = Server("test-bad-host")
     manager = StreamableHTTPSessionManager(
         app=app,
-        security_settings=TransportSecuritySettings(
-            enable_dns_rebinding_protection=True, allowed_hosts=["127.0.0.1"]
-        ),
+        security_settings=TransportSecuritySettings(enable_dns_rebinding_protection=True, allowed_hosts=["127.0.0.1"]),
     )
 
     async with manager.run():