mcp 0.22.0 → 0.24.0

data/lib/mcp/server/transports/streamable_http_transport.rb

@@ -24,17 +24,97 @@ module MCP
           "Connection" => "keep-alive",
         }.freeze
 
-        def initialize(server, stateless: false, enable_json_response: false, session_idle_timeout: nil)
+        # Secure defaults for stateful mode. Without a finite idle timeout, sessions live until an explicit client DELETE,
+        # so an unauthenticated `initialize` flood retains unbounded `ServerSession` objects until memory is exhausted.
+        # These defaults expire idle sessions and cap the concurrent count, like the C# SDK (the only reference SDK that
+        # hardens this by default, with a 2h idle timeout and a 10k idle-session count). One difference: at the cap this transport
+        # rejects a new `initialize` with 503 (after reclaiming any already-expired slots), whereas the C# SDK evicts
+        # the oldest idle session. Rejecting keeps established sessions stable and avoids evicting a legitimate idle session on
+        # an attacker's behalf, at the cost of refusing new sessions while genuinely full. Pass `session_idle_timeout: nil` to
+        # opt out of expiry and `max_sessions: nil` to opt out of the cap.
+        DEFAULT_SESSION_IDLE_TIMEOUT = 1800
+        DEFAULT_MAX_SESSIONS = 10_000
+
+        # Distinguishes "argument omitted, apply the secure default" from an explicit `nil` (opt out of expiry).
+        UNSET_IDLE_TIMEOUT = Object.new.freeze
+        private_constant :UNSET_IDLE_TIMEOUT
+
+        # Default upper bound on the JSON-RPC request body. `handle_post` reads the whole
+        # body into memory and parses it, so without a cap a single unauthenticated POST
+        # can allocate gigabytes and OOM the worker. 4 MiB comfortably
+        # fits a typical JSON-RPC request (a 4 MiB JSON string decodes to ~3 MiB of base64
+        # payload); raise `max_request_bytes:` for unusually large payloads. Matches the
+        # TypeScript SDK's 4 MB default.
+        DEFAULT_MAX_REQUEST_BYTES = 4 * 1024 * 1024
+
+        # Conservative bound on JSON nesting depth, so a deeply nested body cannot exhaust
+        # the stack or amplify parse cost (complements the byte cap).
+        MAX_JSON_NESTING = 64
+
+        # Creates a Streamable HTTP transport that can be mounted as a Rack app.
+        #
+        # @param server [MCP::Server] the server whose requests this transport dispatches.
+        # @param stateless [Boolean] when `true`, no session is issued and each POST is self-contained.
+        # @param enable_json_response [Boolean] when `true`, a request is answered with a single JSON
+        #   object instead of an SSE stream.
+        # @param session_idle_timeout [Numeric, nil] seconds before an idle session is reaped; defaults
+        #   to `DEFAULT_SESSION_IDLE_TIMEOUT` (1800) in stateful mode, and an explicit `nil` disables
+        #   expiry. Not supported in stateless mode.
+        # @param max_sessions [Integer, nil] cap on the concurrent session count in stateful mode; a new
+        #   `initialize` past the cap is rejected with HTTP 503, and `nil` disables the cap.
+        # @param allowed_origins [Array<String>, nil] extra `Origin` values accepted in addition to
+        #   same-origin requests, for DNS rebinding protection.
+        # @param allowed_hosts [Array<String>, nil] extra `Host` values accepted beyond the loopback
+        #   defaults (`127.0.0.1`, `::1`, `localhost`); each entry matches a bare host name (any port)
+        #   or a full `host:port`.
+        # @param dns_rebinding_protection [Boolean] when `true` (default), validates the `Host` and
+        #   `Origin` headers to prevent DNS rebinding; pass `false` when an upstream proxy already
+        #   validates them.
+        # @param session_request_validator [#call, nil] An optional
+        #   `->(request, session_id) { true | false }` invoked on every non-`initialize` POST, GET, and DELETE
+        #   against an existing session (regular requests, notifications, and client responses alike).
+        #   Returning a falsy value rejects the request with HTTP 403. The SDK issues a random `SecureRandom.uuid`
+        #   session ID and otherwise only checks existence/idle-timeout, so binding a session to a user is
+        #   the deploying application's responsibility (the transport never receives the authenticated identity
+        #   on its own); this is the seam to enforce ownership and mitigate session poisoning. Without a validator,
+        #   ownership is not enforced.
+        # @param max_request_bytes [Integer] upper bound in bytes on a POST request body; larger
+        #   requests are rejected with HTTP 413. Defaults to 4 MiB.
+        def initialize(
+          server,
+          stateless: false,
+          enable_json_response: false,
+          session_idle_timeout: UNSET_IDLE_TIMEOUT,
+          max_sessions: DEFAULT_MAX_SESSIONS,
+          allowed_origins: nil,
+          allowed_hosts: nil,
+          dns_rebinding_protection: true,
+          session_request_validator: nil,
+          max_request_bytes: DEFAULT_MAX_REQUEST_BYTES
+        )
           super(server)
-          # Maps `session_id` to `{ get_sse_stream: stream_object, server_session: ServerSession, last_active_at: float_from_monotonic_clock }`.
+          # Maps `session_id` to `{ get_sse_stream: stream_object, server_session: ServerSession, last_active_at: float_from_monotonic_clock, origin: origin_header }`.
           @sessions = {}
           @mutex = Mutex.new
 
           @stateless = stateless
           @enable_json_response = enable_json_response
-          @session_idle_timeout = session_idle_timeout
+          @session_request_validator = session_request_validator
+          @dns_rebinding_protection = dns_rebinding_protection
+
+          # Host names are case-insensitive, so the allow lists are compared down-cased.
+          @allowed_hosts = (DEFAULT_LOOPBACK_HOSTS + Array(allowed_hosts)).map(&:downcase).freeze
+          @allowed_origins = Array(allowed_origins).map(&:downcase).freeze
           @pending_responses = {}
 
+          # Resolve the idle timeout: an explicit value (including `nil` to opt out) wins; otherwise apply the secure default,
+          # which does not apply to stateless mode since it retains no sessions.
+          @session_idle_timeout = if session_idle_timeout.equal?(UNSET_IDLE_TIMEOUT)
+            stateless ? nil : DEFAULT_SESSION_IDLE_TIMEOUT
+          else
+            session_idle_timeout
+          end
+
           if @session_idle_timeout
             if @stateless
               raise ArgumentError, "session_idle_timeout is not supported in stateless mode."
@@ -43,6 +123,19 @@ module MCP
             end
           end
 
+          unless max_sessions.nil? || (max_sessions.is_a?(Integer) && max_sessions > 0)
+            raise ArgumentError, "max_sessions must be a positive Integer or nil"
+          end
+
+          # The cap guards the stateful session store; stateless mode keeps none.
+          @max_sessions = stateless ? nil : max_sessions
+
+          unless max_request_bytes.is_a?(Integer) && max_request_bytes > 0
+            raise ArgumentError, "max_request_bytes must be a positive Integer"
+          end
+
+          @max_request_bytes = max_request_bytes
+
           start_reaper_thread if @session_idle_timeout
         end
 
@@ -52,12 +145,19 @@ module MCP
         STREAM_WRITE_ERRORS = [IOError, Errno::EPIPE, Errno::ECONNRESET].freeze
         SESSION_REAP_INTERVAL = 60
 
+        # Loopback hosts always accepted by DNS rebinding protection. A locally bound MCP server (the canonical pattern) is
+        # protected out of the box; non-loopback deployments widen the list via `allowed_hosts:`.
+        DEFAULT_LOOPBACK_HOSTS = ["127.0.0.1", "::1", "localhost"].freeze
+
         # Rack app interface. This transport can be mounted as a Rack app.
         def call(env)
           handle_request(Rack::Request.new(env))
         end
 
         def handle_request(request)
+          rebinding_error = validate_dns_rebinding(request)
+          return rebinding_error if rebinding_error
+
           case request.env["REQUEST_METHOD"]
           when "POST"
             handle_post(request)
@@ -96,80 +196,107 @@ module MCP
           }
           notification[:params] = params if params
 
+          if session_id
+            deliver_targeted_notification(notification, session_id, related_request_id)
+          else
+            deliver_broadcast_notification(notification)
+          end
+        end
+
+        def deliver_targeted_notification(notification, session_id, related_request_id)
+          # JSON response mode returns a single JSON object as the POST response,
+          # so request-scoped notifications (e.g. progress, log) cannot be delivered
+          # alongside it. Session-scoped standalone notifications
+          # (e.g. `resources/updated`, `elicitation/complete`) still flow via GET SSE.
+          return false if @enable_json_response && related_request_id
+
           streams_to_close = []
 
-          result = @mutex.synchronize do
-            if session_id
-              # JSON response mode returns a single JSON object as the POST response,
-              # so request-scoped notifications (e.g. progress, log) cannot be delivered
-              # alongside it. Session-scoped standalone notifications
-              # (e.g. `resources/updated`, `elicitation/complete`) still flow via GET SSE.
-              next false if @enable_json_response && related_request_id
-
-              # Send to specific session
-              if (session = @sessions[session_id])
-                stream = active_stream(session, related_request_id: related_request_id)
-              end
-              next false unless stream
+          # Resolve the target stream under the lock, then write outside it: a stalled SSE reader
+          # must not block every other session that needs `@mutex`.
+          stream = @mutex.synchronize do
+            next unless (session = @sessions[session_id])
+
+            if session_expired?(session)
+              cleanup_and_collect_stream(session_id, streams_to_close)
+              next
+            end
+
+            active_stream(session, related_request_id: related_request_id)
+          end
+
+          close_streams(streams_to_close)
+          return false unless stream
+
+          write_notification(stream, notification, session_id, related_request_id)
+        end
+
+        def deliver_broadcast_notification(notification)
+          streams_to_close = []
+
+          # Snapshot the connected streams under the lock, then write to each outside it.
+          targets = @mutex.synchronize do
+            expired_session_ids = []
+
+            collected = @sessions.filter_map do |session_id, session|
+              next unless (stream = session[:get_sse_stream])
 
               if session_expired?(session)
-                cleanup_and_collect_stream(session_id, streams_to_close)
-                next false
+                expired_session_ids << session_id
+                next
               end
 
-              begin
-                send_to_stream(stream, notification)
-                true
-              rescue *STREAM_WRITE_ERRORS => e
-                MCP.configuration.exception_reporter.call(
-                  e,
-                  { session_id: session_id, error: "Failed to send notification" },
-                )
-                if related_request_id && session[:post_request_streams]&.key?(related_request_id)
-                  session[:post_request_streams].delete(related_request_id)
-                  streams_to_close << stream
-                else
-                  cleanup_and_collect_stream(session_id, streams_to_close)
-                end
-                false
-              end
-            else
-              # Broadcast to all connected SSE sessions
-              sent_count = 0
-              failed_sessions = []
+              [session_id, stream]
+            end
 
-              @sessions.each do |sid, session|
-                next unless (stream = session[:get_sse_stream])
+            expired_session_ids.each do |session_id|
+              cleanup_and_collect_stream(session_id, streams_to_close)
+            end
 
-                if session_expired?(session)
-                  failed_sessions << sid
-                  next
-                end
+            collected
+          end
 
-                begin
-                  send_to_stream(stream, notification)
-                  sent_count += 1
-                rescue *STREAM_WRITE_ERRORS => e
-                  MCP.configuration.exception_reporter.call(
-                    e,
-                    { session_id: sid, error: "Failed to send notification" },
-                  )
-                  failed_sessions << sid
-                end
-              end
+          close_streams(streams_to_close)
+
+          targets.count do |session_id, stream|
+            write_notification(stream, notification, session_id, nil)
+          end
+        end
+
+        # Writes a notification to an SSE stream without holding `@mutex`. On a write error,
+        # drops the broken stream and returns false; on success returns true.
+        def write_notification(stream, notification, session_id, related_request_id)
+          send_to_stream(stream, notification)
+          true
+        rescue *STREAM_WRITE_ERRORS => e
+          MCP.configuration.exception_reporter.call(e, { session_id: session_id, error: "Failed to send notification" })
+          drop_broken_stream(session_id, stream, related_request_id)
+          false
+        end
 
-              # Clean up failed sessions
-              failed_sessions.each { |sid| cleanup_and_collect_stream(sid, streams_to_close) }
+        # Removes a stream that failed to accept a write. A request-scoped stream is dropped on its own;
+        # a session-scoped (GET SSE) failure tears down the whole session. The `@sessions` mutation runs
+        # under `@mutex`, and the affected streams are closed outside it.
+        def drop_broken_stream(session_id, stream, related_request_id)
+          streams_to_close = []
 
-              sent_count
+          @mutex.synchronize do
+            session = @sessions[session_id]
+            if related_request_id && session&.dig(:post_request_streams, related_request_id)
+              session[:post_request_streams].delete(related_request_id)
+              streams_to_close << stream
+            else
+              cleanup_and_collect_stream(session_id, streams_to_close)
             end
           end
 
-          streams_to_close.each do |stream|
+          close_streams(streams_to_close)
+        end
+
+        def close_streams(streams)
+          streams.each do |stream|
             close_stream_safely(stream)
           end
-
-          result
         end
 
         # Sends a server-to-client JSON-RPC request (e.g., `sampling/createMessage`) and
@@ -199,27 +326,25 @@ module MCP
           request = { jsonrpc: "2.0", id: request_id, method: method }
           request[:params] = params if params
 
-          sent = false
-
-          @mutex.synchronize do
+          # Register the pending response and resolve the stream under the lock, but perform
+          # the write outside it so a stalled reader cannot block every other session on `@mutex`.
+          stream = @mutex.synchronize do
             unless (session = @sessions[session_id])
               raise "Session not found: #{session_id}."
             end
 
             @pending_responses[request_id] = { queue: queue, session_id: session_id }
 
-            if (stream = active_stream(session, related_request_id: related_request_id))
-              begin
-                send_to_stream(stream, request)
-                sent = true
-              rescue *STREAM_WRITE_ERRORS
-                if related_request_id && session[:post_request_streams]&.key?(related_request_id)
-                  session[:post_request_streams].delete(related_request_id)
-                  close_stream_safely(stream)
-                else
-                  cleanup_session_unsafe(session_id)
-                end
-              end
+            active_stream(session, related_request_id: related_request_id)
+          end
+
+          sent = false
+          if stream
+            begin
+              send_to_stream(stream, request)
+              sent = true
+            rescue *STREAM_WRITE_ERRORS
+              drop_broken_stream(session_id, stream, related_request_id)
             end
           end
 
@@ -340,7 +465,9 @@ module MCP
           content_type_error = validate_content_type(request)
           return content_type_error if content_type_error
 
-          body_string = request.body.read
+          body_string = read_bounded_body(request)
+          return payload_too_large_response if body_string.nil?
+
           session_id = extract_session_id(request)
 
           begin
@@ -359,7 +486,9 @@ module MCP
           # The `MCP-Protocol-Version` header is only meaningful after negotiation, so on `initialize`
           # the JSON-RPC body `params.protocolVersion` is authoritative and the header (if any) is ignored.
           # This matches the TypeScript and Python SDKs.
-          unless initialize_request?(body)
+          # `server/discover` (SEP-2575) is likewise exempt: it is sessionless capability discovery that
+          # happens before (or instead of) negotiation.
+          unless initialize_request?(body) || discover_request?(body)
             return missing_session_id_response if !@stateless && !session_id
 
             protocol_version_error = validate_protocol_version_header(request)
@@ -378,16 +507,25 @@ module MCP
               return session_not_found_response
             end
 
-            handle_initialization(body_string, body)
-          elsif notification?(body)
-            dispatch_notification(body_string, session_id)
-            handle_accepted
-          elsif response?(body)
-            return session_not_found_response if !@stateless && !session_exists?(session_id)
-
-            handle_response(body, session_id: session_id)
+            handle_initialization(request, body_string, body)
           else
-            handle_regular_request(body_string, session_id, related_request_id: body[:id])
+            # Ownership gate for every request against an existing session, applied uniformly to notifications, client responses,
+            # and regular requests. This covers write paths beyond tool calls - notably `notifications/cancelled`, which would
+            # otherwise let a stolen session ID cancel a victim's in-flight request. `initialize` is exempt (it establishes the session).
+            if !@stateless && session_id && !validate_session_request(request, session_id)
+              return forbidden_response
+            end
+
+            if notification?(body)
+              dispatch_notification(body_string, session_id)
+              handle_accepted
+            elsif response?(body)
+              return session_not_found_response if !@stateless && !session_exists?(session_id)
+
+              handle_response(body, session_id: session_id)
+            else
+              handle_regular_request(body_string, session_id, related_request_id: body[:id])
+            end
           end
         rescue StandardError => e
           MCP.configuration.exception_reporter.call(e, { request: body_string })
@@ -412,6 +550,7 @@ module MCP
 
           error_response = validate_and_touch_session(session_id)
           return error_response if error_response
+          return forbidden_response unless validate_session_request(request, session_id)
 
           protocol_version_error = validate_protocol_version_header(request)
           return protocol_version_error if protocol_version_error
@@ -434,6 +573,7 @@ module MCP
 
           return missing_session_id_response unless (session_id = extract_session_id(request))
           return session_not_found_response unless session_exists?(session_id)
+          return forbidden_response unless validate_session_request(request, session_id)
 
           protocol_version_error = validate_protocol_version_header(request)
           return protocol_version_error if protocol_version_error
@@ -495,6 +635,27 @@ module MCP
           request.env["HTTP_MCP_SESSION_ID"]
         end
 
+        # Session-ownership gate for requests against an existing session (the spec's session-binding guidance).
+        # The session ID alone is unguessable but not proof of ownership, so a stolen ID must not silently grant access.
+        # Two layers, both returning `false` to trigger a 403:
+        #
+        # - Built-in Origin consistency (defense in depth, not authentication): if the session recorded an `Origin`
+        #   at `initialize` and this request carries a different one, reject. Both must be present to compare,
+        #   so non-browser clients that send no `Origin` are unaffected.
+        # - The application-supplied `session_request_validator`, which can enforce true ownership when it has
+        #   an authenticated principal.
+        def validate_session_request(request, session_id)
+          session = @mutex.synchronize { @sessions[session_id] }
+          return true unless session
+
+          session_origin = session[:origin]
+          request_origin = request.env["HTTP_ORIGIN"]
+          return false if session_origin && request_origin && session_origin != request_origin
+          return @session_request_validator.call(request, session_id) if @session_request_validator
+
+          true
+        end
+
         def validate_accept_header(request, required_types)
           accept_header = request.env["HTTP_ACCEPT"]
           return not_acceptable_response(required_types) unless accept_header
@@ -534,8 +695,34 @@ module MCP
           )
         end
 
+        # Reads the request body with a hard byte cap so an unbounded POST cannot exhaust
+        # memory. A declared `Content-Length` over the cap is rejected
+        # without reading; the actual read is also bounded to one byte past the cap, so
+        # a missing or spoofed `Content-Length` (e.g. chunked transfer) is still caught.
+        # Returns `nil` when the body exceeds the cap.
+        def read_bounded_body(request)
+          content_length = request.content_length
+          return if content_length && content_length.to_i > @max_request_bytes
+
+          body = request.body.read(@max_request_bytes + 1)
+          return "" if body.nil?
+          return if body.bytesize > @max_request_bytes
+
+          body
+        end
+
+        def payload_too_large_response
+          json_rpc_error_response(
+            status: 413,
+            code: JsonRpcHandler::ErrorCode::INVALID_REQUEST,
+            message: "Payload too large: request body exceeds #{@max_request_bytes} bytes",
+          )
+        end
+
         def parse_request_body(body_string)
-          JSON.parse(body_string, symbolize_names: true)
+          # `max_nesting` bounds parse depth; a too-deep body raises `JSON::NestingError`,
+          # a subclass of `JSON::ParserError`, so it is caught below as a parse error.
+          JSON.parse(body_string, symbolize_names: true, max_nesting: MAX_JSON_NESTING)
         rescue JSON::ParserError, TypeError
           raise InvalidJsonError
         end
@@ -552,6 +739,10 @@ module MCP
           body.is_a?(Hash) && body[:method] == Methods::INITIALIZE
         end
 
+        def discover_request?(body)
+          body.is_a?(Hash) && body[:method] == Methods::SERVER_DISCOVER
+        end
+
         def validate_protocol_version_header(request)
           header_value = request.env["HTTP_MCP_PROTOCOL_VERSION"] || MCP::Configuration::DEFAULT_NEGOTIATED_PROTOCOL_VERSION
           return if MCP::Configuration::SUPPORTED_STABLE_PROTOCOL_VERSIONS.include?(header_value)
@@ -613,7 +804,7 @@ module MCP
           handle_accepted
         end
 
-        def handle_initialization(body_string, body)
+        def handle_initialization(request, body_string, body)
           session_id = nil
 
           if @stateless
@@ -622,13 +813,33 @@ module MCP
             session_id = SecureRandom.uuid
             server_session = ServerSession.new(server: @server, transport: self, session_id: session_id)
 
-            @mutex.synchronize do
+            # Cap the concurrent session count so an `initialize` flood cannot retain unbounded sessions until memory is exhausted.
+            # The check and insert share the mutex so concurrent initializes cannot race past the limit.
+            reclaimed = []
+            inserted = @mutex.synchronize do
+              # When at the cap, first reclaim slots held by already-expired sessions the 60s reaper has not yet collected,
+              # so the cap rejects only when genuinely full rather than up to a reaper interval after sessions expired.
+              if @max_sessions && @sessions.size >= @max_sessions
+                @sessions.each_key.select { |id| session_expired?(@sessions[id]) }.each do |id|
+                  cleanup_and_collect_stream(id, reclaimed)
+                end
+              end
+
+              next false if @max_sessions && @sessions.size >= @max_sessions
+
               @sessions[session_id] = {
                 get_sse_stream: nil,
                 server_session: server_session,
                 last_active_at: Process.clock_gettime(Process::CLOCK_MONOTONIC),
+                # Captured for the built-in Origin-consistency defense in `validate_session_request`.
+                # Not authentication.
+                origin: request.env["HTTP_ORIGIN"],
               }
+              true
             end
+
+            reclaimed.each { |stream| close_stream_safely(stream) }
+            return too_many_sessions_response unless inserted
           end
 
           response = server_session.handle_json(body_string)
@@ -655,6 +866,14 @@ module MCP
           [202, {}, []]
         end
 
+        def too_many_sessions_response
+          json_rpc_error_response(
+            status: 503,
+            code: JsonRpcHandler::ErrorCode::INTERNAL_ERROR,
+            message: "Service unavailable: maximum concurrent sessions (#{@max_sessions}) reached",
+          )
+        end
+
         def handle_regular_request(body_string, session_id, related_request_id: nil)
           server_session = nil
 
@@ -808,6 +1027,74 @@ module MCP
           active
         end
 
+        # Per MCP 2025-11-25, servers MUST validate the `Origin` header and SHOULD bind only to localhost
+        # to prevent DNS rebinding attacks against locally bound MCP servers. Protection is on by default;
+        # pass `dns_rebinding_protection: false` to disable it (e.g. when an upstream proxy or middleware already
+        # performs the check). The `Host` header is validated against the loopback defaults plus `allowed_hosts:`,
+        # and the `Origin` header, when present, must be same-origin or in `allowed_origins:`.
+        def validate_dns_rebinding(request)
+          return unless @dns_rebinding_protection
+
+          validate_host(request) || validate_origin(request)
+        end
+
+        # Rejects a rebound `Host` (e.g. `evil.example.com` re-pointed at 127.0.0.1).
+        # A request without a `Host` header (e.g. HTTP/1.0) is allowed; the rebinding vector this guards against always carries one.
+        def validate_host(request)
+          host = request.env["HTTP_HOST"]
+          return if host.nil?
+
+          # An `allowed_hosts:` entry matches either the bare host name (any port)
+          # or the full `host:port` value, so both `"app.example.com"` and
+          # `"app.example.com:8443"` can be configured.
+          normalized = host.downcase
+          return if @allowed_hosts.include?(request_hostname(normalized)) || @allowed_hosts.include?(normalized)
+
+          forbidden_response("Forbidden: Invalid Host header")
+        end
+
+        # A request without an `Origin` header (typical for non-browser MCP clients) is allowed. A browser cross-origin request is
+        # rejected unless the origin is same-origin or explicitly allow-listed via `allowed_origins:`.
+        def validate_origin(request)
+          origin = request.env["HTTP_ORIGIN"]
+          return if origin.nil?
+          return if same_origin?(origin, request)
+          return if @allowed_origins.include?(origin.downcase)
+
+          forbidden_response("Forbidden: Invalid Origin header")
+        end
+
+        # Extracts the host name from a `Host` header value, stripping any port and IPv6 brackets
+        # (`[::1]:8080` becomes `::1`, `127.0.0.1:8080` becomes `127.0.0.1`).
+        def request_hostname(host)
+          return host[/\A\[([^\]]+)\]/, 1] if host.start_with?("[")
+
+          host.split(":").first
+        end
+
+        # Compares the `Origin` authority (host:port) against the request's own `Host`.
+        # Scheme is not compared (the `Host` header carries none, and `request.scheme` is unreliable behind proxies),
+        # but the `Origin`'s scheme is used to drop a redundant default port (`:80` for http, `:443` for https) from
+        # both sides so `http://example.com` matches `Host: example.com:80`. Comparison is case-insensitive.
+        def same_origin?(origin, request)
+          host = request.env["HTTP_HOST"]
+          return false if host.nil?
+
+          normalized = origin.downcase
+          default_port = normalized.start_with?("https://") ? ":443" : ":80"
+          authority = normalized.sub(%r{\Ahttps?://}, "")
+
+          authority.delete_suffix(default_port) == host.downcase.delete_suffix(default_port)
+        end
+
+        def forbidden_response(message = "Forbidden: session request validation failed")
+          json_rpc_error_response(
+            status: 403,
+            code: JsonRpcHandler::ErrorCode::INVALID_REQUEST,
+            message: message,
+          )
+        end
+
         def method_not_allowed_response
           json_rpc_error_response(
             status: 405,
@@ -902,11 +1189,15 @@ module MCP
         end
 
         def send_keepalive_ping(session_id)
-          @mutex.synchronize do
-            if @sessions[session_id] && @sessions[session_id][:get_sse_stream]
-              send_ping_to_stream(@sessions[session_id][:get_sse_stream])
-            end
+          # Resolve the stream under the lock, then write outside it so a stalled reader
+          # cannot block every other session on `@mutex`.
+          stream = @mutex.synchronize do
+            session = @sessions[session_id]
+            session && session[:get_sse_stream]
           end
+          return unless stream
+
+          send_ping_to_stream(stream)
         rescue *STREAM_WRITE_ERRORS => e
           MCP.configuration.exception_reporter.call(
             e,