Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Protocol tab leaves a request PENDING when the server denies it with a bare HTTP 403

Cerrado
  • ¿Algo no está bien?
#2,721 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@cliffhall ya está trabajando en esto.

Desde el 20/10/2026.

  • #2733 de @cliffhall — fusionado

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
50/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
typescript
Área
frontend

Línea de trabajo

Start by reproducing with a reverse proxy that returns a bare 403 for tools/call, then compare the Protocol tab's request entry with the Tools panel error path that already shows 'Error POSTing to endpoint: Forbidden'. Find where a 403 response is handled for the Protocol entry and make it resolve as an error carrying the HTTP status. Done when the echo call and subscriptions/listen both show an error in Protocol, the Subscriptions section shows the refused listen, and the listen is no longer re-sent after a definitive 403.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug v2

Problem

When a server denies a JSON-RPC request with a bare HTTP 403 Forbidden (no WWW-Authenticate header), the web client's Protocol tab never resolves that request's entry. It stays PENDING for good, instead of showing the failure.

The failure is reported elsewhere:

  • The Tools panel shows Tool Error: "Error POSTing to endpoint: Forbidden".
  • The connection stays connected. That is correct since #2515 / PR #2690, which stopped a bare 403 from starting OAuth discovery.

So the Protocol tab, the surface meant to record what happened on the wire, disagrees with the rest of the UI about whether the request finished.

It is pre-existing: 2.10.1 does the same. It was found during the v2.11.0 milestone smoke (#2718), while driving #2515.

Reproduce

  1. Put a reverse proxy in front of an HTTP test server that answers one JSON-RPC method with a bare 403 Forbidden: no body that matters, no WWW-Authenticate. Let everything else through.
  2. Connect the web client (prod --web) to the proxy.
  3. Legacy: run the echo tool while the proxy 403s tools/call.
  4. Modern: subscribe to a resource on a subscriptions server while the proxy 403s subscriptions/listen.
  5. Open the monitoring sidebar → Protocol.

Observed

  • tools/call echo stays PENDING.
  • subscriptions/listen stays PENDING. On modern, the UI also re-sends subscriptions/listen about 7 times in ~5s after the 403, and the Subscriptions section never surfaces the denial.
  • The proxy log confirms each request got its 403 response immediately.

Expected

The entry resolves as an error carrying the HTTP status, and the Subscriptions section shows that the listen was refused. The repeated re-send after a definitive 403 is worth a look in the same pass.

Lenguaje dominante
TypeScript
Estrellas
11.1k
Forks
1.6k
Merge medio
4 h 56 min
PR fusionados (30 d)
155

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de modelcontextprotocol/inspector

Todos los issues de modelcontextprotocol/inspector

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.