Duplicate initialize is accepted after initialization and returns a new session ID #962

Activity

1. DragonFSKY commented on May 18, 2026

   

   DragonFSKY

   on May 18, 2026

   More actions

   Hi, thanks for the detailed report.

   I took a look at this and I think the behavior is likely caused by the Streamable HTTP initialize path handling initialize before checking the existing Mcp-Session-Id. That means a later initialize request with an active session ID can currently reach sessionFactory.startSession(...) and receive a fresh session ID.

   My intended fix is to keep fresh initialize requests without a session ID working as before, but reject duplicate initialize requests that include an existing active Mcp-Session-Id in the stateful Streamable HTTP transport, with a focused regression test for that path.

   If there are any concerns with this direction, please feel free to point them out.

   ❤️React with ❤️1Reacted by CCLAB
2. tzolov

   added

   bugSomething isn't workingSomething isn't working

   ready for workThe goal is clear and work towards it can be commencedThe goal is clear and work towards it can be commenced

   P2Moderate issues affecting some users, edge cases, potentially valuable featureModerate issues affecting some users, edge cases, potentially valuable feature

   on Aug 17, 2026
3. tzolov

   added the

   Bug

   issue type on Aug 17, 2026
4. steven-ji commented on Aug 22, 2026

   

   steven-ji

   on Aug 22, 2026

   More actions

   I would like to work on this issue.

   I verified that the current main path still handles initialize before checking an existing Mcp-Session-Id, and that the earlier PR #969 is closed.

   I will keep the change focused on rejecting a duplicate initialize request only when it carries an active session ID, while preserving fresh initialization without a session ID. I will also add a focused servlet-level regression test for initialize -> initialized -> duplicate initialize -> rejected.
5. Kehrlann

   added

   invalidThis doesn't seem rightThis doesn't seem right

   on Sep 4, 2026
6. Kehrlann commented on Sep 4, 2026

   

   Kehrlann

   on Sep 4, 2026

   Last edited by Kehrlann

   Contributor

   More actions

   The spec does not say anything about the initialize request and the presence of an existing session ID. What's happening here is that the session ID header is ignored entirely, and a brand new session is created.
   There is no override or session leak.

   Given the following tool definition:

   McpServerFeatures.SyncToolSpecification.builder()
   	.tool(Tool.builder("caps", EMPTY_JSON_SCHEMA).description("Returns client capabilities").build())
   	.callHandler((exchange, request) -> {
   		return CallToolResult.builder()
   			.addTextContent(exchange.getClientInfo().name())
   			.isError(false)
   			.build();
   	})
   	.build();

   Here's a script to verify that when you initialize a second session while passing a session ID, the initial session stays untouched:

   #!/usr/bin/env bash
   
   ENDPOINT=http://localhost:8080/mcp
   
   INIT_RESULT_ONE=$(curl -i -sS --http1.1 -X POST "$ENDPOINT" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json, text/event-stream' \
     --data '{"jsonrpc":"2.0","id":"init-1","method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{"roots":{"listChanged":true},"sampling":{}},"clientInfo":{"name":"repro-one","version":"1.0.0"}}}')
   echo "Initialization one"
   SID_ONE=$(echo "$INIT_RESULT_ONE" | sed -n 's/Mcp-Session-Id: \(.*\)\r/\1/p')
   echo "SID one: ${SID_ONE}"
   echo "~~~~~~~"
   
   curl -sS --http1.1 -X POST "$ENDPOINT" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json, text/event-stream' \
     -H "Mcp-Session-Id: ${SID_ONE}" \
     --data '{"jsonrpc":"2.0","method":"notifications/initialized","params":{}}'
   echo "Initialized one"
   echo "~~~~~~~"
   
   TC_ONE=$(curl -i -sS --http1.1 -X POST "$ENDPOINT" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json, text/event-stream' \
     -H "Mcp-Session-Id: ${SID_ONE}" \
     --data '{"jsonrpc":"2.0", "id": "tc-1", "method":"tools/call","params":{"name":"caps"}}')
   TC_ONE_SESSION_NAME=$(echo "$TC_ONE" | sed -n 's/data: \(.*\)/\1/p' | jq -r ".result.content[0].text")
   echo "Session one was initialized with name: $TC_ONE_SESSION_NAME"
   echo "~~~~~~~"
   
   
   INIT_RESULT_TWO=$(curl -i -sS --http1.1 -X POST "$ENDPOINT" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json, text/event-stream' \
     -H "Mcp-Session-Id: ${SID_ONE}" \
     --data '{"jsonrpc":"2.0","id":"init-1","method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{"roots":{"listChanged":true},"sampling":{}},"clientInfo":{"name":"repro-two","version":"1.0.0"}}}')
   echo "Initialization two"
   SID_TWO=$(echo "$INIT_RESULT_TWO" | sed -n 's/Mcp-Session-Id: \(.*\)\r/\1/p')
   echo "SID two: ${SID_TWO}"
   echo "~~~~~~~"
   
   curl -sS --http1.1 -X POST "$ENDPOINT" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json, text/event-stream' \
     -H "Mcp-Session-Id: ${SID_TWO}" \
     --data '{"jsonrpc":"2.0","method":"notifications/initialized","params":{}}'
   echo "Initialized two"
   echo "~~~~~~~"
   
   TC_TWO=$(curl -i -sS --http1.1 -X POST "$ENDPOINT" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json, text/event-stream' \
     -H "Mcp-Session-Id: ${SID_TWO}" \
     --data '{"jsonrpc":"2.0", "id": "tc-1", "method":"tools/call","params":{"name":"caps"}}')
   TC_ONE=$(curl -i -sS --http1.1 -X POST "$ENDPOINT" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json, text/event-stream' \
     -H "Mcp-Session-Id: ${SID_ONE}" \
     --data '{"jsonrpc":"2.0", "id": "tc-1", "method":"tools/call","params":{"name":"caps"}}')
   TC_ONE_SESSION_NAME=$(echo "$TC_ONE" | sed -n 's/data: \(.*\)/\1/p' | jq -r ".result.content[0].text")
   TC_TWO_SESSION_NAME=$(echo "$TC_TWO" | sed -n 's/data: \(.*\)/\1/p' | jq -r ".result.content[0].text")
   echo "Session 1 was initialized with name: $TC_ONE_SESSION_NAME"
   echo "Session 2 was initialized with name: $TC_TWO_SESSION_NAME"
   echo "~~~~~~~"

   👍React with 👍1Reacted by CCLAB
7. Kehrlann

   closed this as not plannedon Sep 4, 2026