Skip to content

fix(server): derive standalone SSE streamId per-session to prevent EventStore collisions#2109

Open
leehpham wants to merge 1 commit into
modelcontextprotocol:mainfrom
leehpham:fix/standalone-sse-stream-id-per-session
Open

fix(server): derive standalone SSE streamId per-session to prevent EventStore collisions#2109
leehpham wants to merge 1 commit into
modelcontextprotocol:mainfrom
leehpham:fix/standalone-sse-stream-id-per-session

Conversation

@leehpham
Copy link
Copy Markdown

Fixes #1004. WebStandardStreamableHTTPServerTransport hardcoded _standaloneSseStreamId to the literal '_GET_stream', so when multiple transport instances shared an EventStore (e.g. Redis-backed for horizontal scaling), every session's GET-SSE notifications were stored under the same streamId - breaking per-session replay isolation.

This converts the field to a getter returning `_GET_stream_${sessionId}` once a session is initialized, preserving the original '_GET_stream' literal in stateless mode for backward compatibility. The _streamMapping is per-instance so its keying is unaffected.

Adds a regression test that runs two transports with distinct sessions against one shared EventStore and asserts the recorded streamIds are distinct, plus a stateless-mode test pinning the literal fallback.

@leehpham leehpham requested a review from a team as a code owner May 16, 2026 15:17
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 16, 2026

⚠️ No Changeset found

Latest commit: 7dce6a1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented May 16, 2026

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2109

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2109

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2109

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2109

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2109

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2109

commit: 7dce6a1

@BossChaos

This comment was marked as abuse.

@BossChaos

This comment was marked as abuse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

storeEvent in EventStore Receives Hardcoded streamId

2 participants