Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Protocol tab leaves a request PENDING when the server denies it with a bare HTTP 403

Chiusa
  • Qualcosa non va?
#2,721 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@cliffhall ci sta già lavorando.

Dal 20/10/2026.

  • #2733 di @cliffhall — integrata

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
50/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
frontend

Direzione di ricerca

Start by reproducing with a reverse proxy that returns a bare 403 for tools/call, then compare the Protocol tab's request entry with the Tools panel error path that already shows 'Error POSTing to endpoint: Forbidden'. Find where a 403 response is handled for the Protocol entry and make it resolve as an error carrying the HTTP status. Done when the echo call and subscriptions/listen both show an error in Protocol, the Subscriptions section shows the refused listen, and the listen is no longer re-sent after a definitive 403.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug v2

Problem

When a server denies a JSON-RPC request with a bare HTTP 403 Forbidden (no WWW-Authenticate header), the web client's Protocol tab never resolves that request's entry. It stays PENDING for good, instead of showing the failure.

The failure is reported elsewhere:

  • The Tools panel shows Tool Error: "Error POSTing to endpoint: Forbidden".
  • The connection stays connected. That is correct since #2515 / PR #2690, which stopped a bare 403 from starting OAuth discovery.

So the Protocol tab, the surface meant to record what happened on the wire, disagrees with the rest of the UI about whether the request finished.

It is pre-existing: 2.10.1 does the same. It was found during the v2.11.0 milestone smoke (#2718), while driving #2515.

Reproduce

  1. Put a reverse proxy in front of an HTTP test server that answers one JSON-RPC method with a bare 403 Forbidden: no body that matters, no WWW-Authenticate. Let everything else through.
  2. Connect the web client (prod --web) to the proxy.
  3. Legacy: run the echo tool while the proxy 403s tools/call.
  4. Modern: subscribe to a resource on a subscriptions server while the proxy 403s subscriptions/listen.
  5. Open the monitoring sidebar → Protocol.

Observed

  • tools/call echo stays PENDING.
  • subscriptions/listen stays PENDING. On modern, the UI also re-sends subscriptions/listen about 7 times in ~5s after the 403, and the Subscriptions section never surfaces the denial.
  • The proxy log confirms each request got its 403 response immediately.

Expected

The entry resolves as an error carrying the HTTP status, and the Subscriptions section shows that the listen was refused. The repeated re-send after a definitive 403 is worth a look in the same pass.

Lingua principale
TypeScript
Stelle
11.1k
Fork
1.6k
Merge medio
5h 29m
PR unite (30g)
158

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di modelcontextprotocol/inspector

Tutte le issue di modelcontextprotocol/inspector

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.