Hacktoberfest 2026：維護者為十月標記出來的 issue，仍然開放、適合新手。 瀏覽 Hacktoberfest issue

2026-07-28 SSE responses share one header list, so in-place middleware appends leak across responses

未關閉 適合新手
  • 哪裡不對？
#3,701 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

  • #3704 來自 @guptaishaan —— 已關閉，未合併

評估

難度
2/5
預估耗時
1-3 小時
新手友好度
68/100
Issue 類型
缺陷
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
python
領域
backend

研究方向

從 handle_modern_request 開始，它以模組層級的列表 _SSE_HEADERS 傳送 SSE 回應。檢查為每個回應複製一份是否能修復就地附加造成的洩漏。在撰寫修復之前，先查看已關閉但未合併的 PR #3704，弄清楚它未被合併的原因。完成標準：tests/server/test_streamable_http_modern.py 中的回歸測試在目前的 main 上失敗，並在每個 SSE 回應都擁有自己的標頭列表後通過。

由索引模型根據 Issue 內容生成。

描述

bug spec-2026-07-28 v2
Initial Checks
Release line

2.x (current stable)

Description

On the 2026-07-28 HTTP entry, handle_modern_request starts every SSE response with the module-level _SSE_HEADERS list itself:

await send({"type": "http.response.start", "status": _OK_STATUS, "headers": _SSE_HEADERS})

ASGI middleware that adds a header with message["headers"].append(...) therefore appends to the SDK's shared list. The header stays there for the life of the process, so every later SSE response carries one more copy, along with the values set for earlier requests. JSON responses aren't affected, because they build their own header list.

We hit this in production with an observability middleware that appended an x-correlation-id. After about 250 SSE responses in one process, our edge proxy's HTTP client rejected the responses as malformed. Only calls that commit to SSE (a notification, or more than 15 s without one) take this path, so fast calls and most test suites never touch it, and a restart hid it for a while.

The middleware shouldn't mutate a list it doesn't own; Starlette's MutableHeaders(scope=message) copies for exactly this reason. Passing list(_SSE_HEADERS) would keep one middleware's mistake from turning into process-wide header growth and cross-request header leakage.

Expected: each SSE response gets its own header list.

Example Code
import asyncio
import httpx
from mcp.server.mcpserver import Context, MCPServer
from mcp.server.transport_security import TransportSecuritySettings

mcp = MCPServer("repro")

@mcp.tool()
async def slow(ctx: Context) -> str:
    await ctx.report_progress(1, 2)  # any notification commits the response to SSE
    return "done"

inner = mcp.streamable_http_app(
    transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False)
)

async def app(scope, receive, send):  # middleware that appends in place
    async def send2(msg):
        if msg["type"] == "http.response.start":
            msg["headers"].append((b"x-correlation-id", b"abc"))
        await send(msg)
    await inner(scope, receive, send2)

def body(i):
    return {"jsonrpc": "2.0", "id": i, "method": "tools/call",
            "params": {"name": "slow", "arguments": {}, "_meta": {
                "progressToken": i,
                "io.modelcontextprotocol/protocolVersion": "2026-07-28",
                "io.modelcontextprotocol/clientInfo": {"name": "r", "version": "0"},
                "io.modelcontextprotocol/clientCapabilities": {}}}}

async def main():
    async with inner.router.lifespan_context(inner):
        async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app), base_url="http://localhost") as c:
            for i in range(1, 6):
                r = await c.post("/mcp", json=body(i), headers={
                    "accept": "application/json, text/event-stream",
                    "mcp-protocol-version": "2026-07-28",
                    "mcp-method": "tools/call", "mcp-name": "slow"})
                print(i, len(r.headers.get_list("x-correlation-id")))

asyncio.run(main())

Output: 1 1, 2 2, 3 3, 4 4, 5 5.

I have a fix ready (list(_SSE_HEADERS) plus a regression test in tests/server/test_streamable_http_modern.py that fails before and passes after) and would be glad to open the PR if you assign this to me. Open PR #3192 carries the same line, in case that's the better place for it.

AI disclosure: I used Claude Code to find the line, write the repro, and draft this issue. I hit the bug in production and have checked the repro and the fix myself.

Python & MCP Python SDK
Python 3.13, mcp 2.3.0 (also present on main at 754254c)
主要語言
Python
星號
24.5k
分支
4k
平均合併
18 小時 31 分鐘
30 天內合併 PR
38

環境準備

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

modelcontextprotocol/python-sdk 的其他 Issue

查看 modelcontextprotocol/python-sdk 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。