[v1.x] Apply the request body limit to the SSE and OAuth endpoints - #3344
Merged
Merged
Claude / Claude Code Review
completed
Aug 21, 2026 in 7m 23s
Code review found 1 new issue (1 earlier finding still open)
Found 1 candidates, confirmed 2: 1 posted in this review, 1 from earlier reviews still open. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 2 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/mcp/server/sse.py:137 |
Minor ordering regression: wrapping _handle_post_message in RequestBodyLimitMiddleware means the SSE message endpoint no |
Annotations
Check warning on line 137 in src/mcp/server/sse.py
claude / Claude Code Review
Minor ordering regression: wrapping _handle_post_message in RequestBodyLimitMiddleware means the SSE message endpoint now reads and buffers the full request body (up to max_request_body_size, 4 MiB default) BEFORE the DNS-rebinding Host/Origin validation,
Minor ordering regression: wrapping _handle_post_message in RequestBodyLimitMiddleware means the SSE message endpoint now reads and buffers the full request body (up to max_request_body_size, 4 MiB default) BEFORE the DNS-rebinding Host/Origin validation, Content-Type check, session_id lookup, and session-ownership check in _handle_post_message run. Before this change, handle_post_message called self._security.validate_request() and the session checks first and sent 400/403/404/421 without ever
Loading