Fix SSE endpoint accepting POST requests instead of returning 405 #1953
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Commit d36ea42 centralized MCP endpoint route creation in auth providers, but didn't specify HTTP methods. This caused the SSE endpoint to accept all methods instead of only GET, breaking proper HTTP semantics. Split responsibilities: auth providers return their own routes (OAuth, metadata), while the transport layer creates protected MCP endpoint routes with correct methods. Closes #1903
marvin-context-protocol
bot
added
bug
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #1903
Problem
After d36ea42, the SSE endpoint (
/sse) started accepting POST requests and returning 200 OK instead of rejecting them with 405 Method Not Allowed. This expected MCP semantics and caused clients (like Claude Desktop) to stop their search and not communicate with the "correct" SSE endpoint via a GET request.The refactoring centralized MCP endpoint route creation in
AuthProvider.get_routes(), but didn't specify HTTP methods, causing routes to accept all methods by default.Solution
Separated responsibilities clearly:
get_routes()) return only their own routes (OAuth endpoints, metadata)http.py) creates the protected MCP endpoint routes with correct methods:methods=["GET"]onlyThis preserves the original behavior while fixing the bug.