[v1.x] Apply the request body limit to the SSE and OAuth endpoints - #3344
[v1.x] Apply the request body limit to the SSE and OAuth endpoints#3344maxisbey merged 2 commits into
Conversation
Sorry, something went wrong.
📚 Documentation preview
|
Sorry, something went wrong.
There was a problem hiding this comment.
Beyond the inline note, a few other candidate issues were checked and ruled out: the middleware's removal of the POST-only special case against Streamable HTTP GET/DELETE handling — the replay wrapper falls through to the live receive, so disconnect delivery on long-lived streams is unaffected; the now-default-on 4 MiB limit for the SSE message endpoint — it is the same FastMCP setting already governing Streamable HTTP and remains configurable on SseServerTransport; and the auth routes' switch from callable endpoints to wrapped ASGI instances — Starlette's Route treats non-function endpoints as ASGI apps, so dispatch and the CORS-outermost ordering behave as described.
Extended reasoning...One inline finding (the pre-existing-equivalent KeyError on non-HTTP scopes in handle_post_message) is posted separately; this note only records what else was examined. Since the diff touches OAuth endpoint wiring in src/mcp/server/auth/routes.py and changes default behavior on the SSE message endpoint (413 on oversized bodies, 405 on non-POST), a human look remains worthwhile, but the specific concerns above — receive-replay semantics after dropping the POST guard, the newly-enforced SSE default limit, and Starlette endpoint-type handling for the restructured auth routes — were each verified against the code and are not problems.
Sorry, something went wrong.
SseServerTransport now takes max_request_body_size (default 4 MiB, the same default and validation as StreamableHTTPSessionManager) and answers 413 before session lookup or parsing when a request declares or streams a larger body. The message endpoint only ever handled POST bodies, so it now answers 405 (Allow: POST) to other methods instead of treating them like a POST. FastMCP forwards its existing max_request_body_size setting to the SSE transport, so one setting governs both HTTP transports. The create_auth_routes endpoints (/token, /revoke, /register and /authorize) are wrapped in RequestBodyLimitMiddleware at the route declarations and answer 413 to bodies over the 4 MiB default before any form or JSON parsing. On the CORS-enabled routes the limit sits inside the CORS wrapper so a 413 still carries CORS headers; cors_middleware itself is unchanged. The middleware no longer special-cases POST, since some of these routes also accept OPTIONS or HEAD and their handlers read the body either way. Differences from the main change: - FastMCP reuses its existing max_request_body_size setting for the SSE app instead of adding keywords to sse_app()/run(); no new FastMCP parameter. - /register reads its body via request.json() on this line; the same wrapper applies unchanged. - Tests use httpx and this line's dict-based SSE scope helper.
…ager module The middleware and DEFAULT_MAX_REQUEST_BODY_SIZE are now used by the SSE transport and the OAuth routes as well, so they move next to the other shared HTTP request checks in mcp.server.transport_security. Both names remain importable from mcp.server.streamable_http_manager (listed in its __all__). The middleware's own unit tests move with it, plus the mid-stream disconnect replay case main already carries; no behaviour change.
v1.x backport of #3336.
#3101 added RequestBodyLimitMiddleware and applied it to the Streamable HTTP endpoint on this line. This does the same for the other two places that accept request bodies, so every HTTP entry point shares the one 4 MiB default.
Motivation and Context
Nothing changes for requests under the limit.
Differences from #3336
How Has This Been Tested?
New tests in tests/server/test_sse_security.py, tests/server/auth/test_error_handling.py, tests/server/test_transport_security.py and tests/server/fastmcp/test_server.py: over-limit bodies (declared and streamed, across methods) get 413, bodies under the limit still reach session lookup / form parsing, CORS preflights are still answered and a 413 on a CORS route keeps its CORS headers, non-POST to the message endpoint gets 405, and sse_app() applies the configured setting. Full suite, pyright and ruff pass locally.
Breaking Changes
None. The new SseServerTransport keyword is optional and defaults to the limit the Streamable HTTP transport already uses; the observable differences are a 413 for request bodies over 4 MiB on these endpoints and a 405 for non-POST requests to the SSE message endpoint.
Types of changes
Checklist
Additional context
None.
AI Disclaimer