fix: reject JSON-RPC requests with id: null instead of misclassifying as notification#2168
Closed
giulio-leone wants to merge 4 commits intomodelcontextprotocol:mainfrom
Closed
Conversation
… as notification When a JSON-RPC message arrives with "id": null, it should be rejected. Both JSON-RPC 2.0 and the MCP spec restrict request IDs to strings or integers. Previously, JSONRPCRequest correctly rejected null IDs, but Pydantic fell through to JSONRPCNotification which silently absorbed the extra "id" field via implicit extra='allow'. The caller got a 202 with no response and no error. Set extra='forbid' on JSONRPCNotification so that any unrecognised field (including "id": null) causes a validation error. Fixes modelcontextprotocol#2057
giulio-leone
force-pushed
the
fix/jsonrpc-null-id-validation
branch
from
faf4158 to
0035dfc
Compare
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Author
|
Closing to reduce noise — focusing on the most impactful PRs. Happy to reopen if there's interest. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reject JSON-RPC messages with
"id": nullinstead of silently misclassifying them as notifications.Problem
When a JSON-RPC request arrives with
"id": null:JSONRPCRequestcorrectly rejects it (nullis not a validRequestId)JSONRPCNotification, which absorbs the extra"id"field via implicitextra='allow'Solution
Set
model_config = ConfigDict(extra='forbid')onJSONRPCNotification. This prevents any unrecognised fields (including"id": null) from being silently absorbed, causing a proper validation error.Tests
Added 6 test cases in
tests/issues/test_2057_null_id.py:test_request_rejects_null_id— JSONRPCRequest rejectsid: nulltest_notification_rejects_extra_id_field— JSONRPCNotification rejects extraidtest_message_adapter_rejects_null_id— Union adapter rejectsid: nulltest_valid_notification_without_id— Normal notifications still worktest_valid_request_with_int_id— Normal int-id requests still worktest_valid_request_with_string_id— Normal string-id requests still workFull test suite: 1128 passed, 2 consecutive clean runs.
Fixes #2057