Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Streamable HTTP client: update the stored endpoint URI after a 308

未关闭
  • 哪里不对？
#1,373 2 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 2 天内回复

@connor4312 已经在做这个了。

开始于 2026年10月16日。

评估

这个 Issue 还没有评估数据。

描述

enhancement P3 T-transport

Follow-up from #1203 and #1367.

Problem

After #1367, the default Streamable HTTP client follows same-origin 307 and 308 redirects. But it never saves the new location. Every request still goes to the configured URI first and gets redirected again.

A 308 means the move is permanent, so the client could send later requests straight to the new URI.

Current behavior

At a156be8, the URI lives in StreamableHttpClientTransportConfig::uri. The worker clones the config once and never changes it. Each request copies the URI from there:

  1. POST: post_request, and the initialize POSTs at startup and in the fallback path.
  2. Standalone GET stream: resumption with Last-Event-ID uses its own copy in StreamableHttpClientReconnect.
  3. SSE on a POST response: resumption gets a copy too.
  4. Re-initialization after a 404: perform_reinitialization.
  5. DELETE on close: SessionCleanupInfo holds its own copy, used at exit.

All of these requests use the same reqwest::Client, so the redirect policy applies to GET and DELETE too, not only POST.

reqwest gives us the final URL through Response::url(), but not the status of each hop. The Policy::custom closure sees each hop's status. However, one policy is shared by every request on the client, and it can't tell which request a hop belongs to.

Proposal

  • Only save the new URI when every hop in the chain is a 308. If any hop is a 307, keep the configured URI.
  • Have the run loop keep the current URI, since it already owns the session state. Use that URI for new POSTs, new GET streams, re-initialization and the DELETE.
  • Return the final URL from the client to the worker. StreamableHttpPostResponse doesn't carry a URL today.

To find out whether every hop was a 308, we could:

  1. Stop on 308 in the policy and follow it by hand in the reqwest StreamableHttpClient impl, with the same origin and hop-limit checks.
  2. Record hops from the policy closure into shared state. This is unreliable when concurrent requests start from the same URI.

Open questions

  • Same-origin is already enforced, so only the path and query can change. Do we need any other check?
  • Should the session ID carry over to the new URI, or should the client re-initialize?
  • OAuth: AuthorizationManager keeps its own base_url. It's the fallback resource, and the protected resource metadata resource is checked against it. If the transport URI moves and base_url doesn't, they no longer match, and there's no way to update base_url today. Should we skip the update when AuthClient wraps the transport, or move both?
  • Requests and streams already in flight keep the old URI. Is that fine, or should resumption pick up the new one?
  • Default client only, or also clients passed to with_client?

Related

  • #1203: the original redirect report
  • #1367: follows same-origin 307/308 in the default client
  • The TypeScript and Python SDKs don't update the stored URL either. Both follow same-origin redirects and keep the configured URL (TypeScript, Python).
主要语言
Rust
星标
4k
派生
688
平均合并
3 天 11 小时
30 天内合并 PR
36

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

modelcontextprotocol/rust-sdk 的其他 Issue

查看 modelcontextprotocol/rust-sdk 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。