Repository navigation
Resolve test server paths deterministically - #1735
Merged
jeffhandley merged 2 commits intoJul 26, 2026
Merged
jeffhandley merged 2 commits into
jeffhandley merged 2 commits into
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: ad8afb00-2809-4785-8781-014a90c8abf1
jeffhandley
approved these changes
Jul 26, 2026
jeffhandley
merged commit Jul 26, 2026
5f5d5ea
into
modelcontextprotocol:main
16 of 17 checks passed
PranavSenthilnathan
deleted the
pranavsenthilnathan-resolve-testserver-paths
branch
July 26, 2026 06:12
jeffhandley
added a commit
that referenced
this pull request
Nov 3, 2026
* Require stable identities for authenticated HTTP sessions Fail closed when authenticated stateful Streamable HTTP or legacy SSE users lack a non-empty NameIdentifier, sub, or UPN claim. Consider all authenticated identities, ignore unauthenticated ownership claims, and preserve claim precedence and type/value/issuer binding. Carry the captured identity through session creation and migration, forward the original authenticated principal, and document IClaimsTransformation for custom identifiers. Cover anonymous-owned session protection, secondary identities, ownership isolation, principal propagation, and migration snapshots with SDK regressions. Squashes the canonical advisory implementation through 44efea55326e791983fa87901f5ad3356d671e0c plus reviewed claim-lookup and test cleanup. Original source fix: bd3b432b3b457da6073b66e5d375eba983aa0bed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> (cherry picked from commit 576fe7a0abad7555fae0cdc498a6f78b502fc433) * Simplify the claims transformation documentation example Show the agreed single-identity custom-user-id mapping with a NameIdentifier idempotency guard and preserved claim issuer. Keep the authentication setup guidance and runtime identity requirements unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> (cherry picked from commit 165b701247d6aed69743d043bb309474762524ad) * Fix enterprise-managed authorization documentation link Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e251dc82-658d-4b6e-a4df-cc4af1e7d408 * Align enterprise authorization spec link with main Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e251dc82-658d-4b6e-a4df-cc4af1e7d408 * Resolve test server paths deterministically (#1735) Copilot-Session: ad8afb00-2809-4785-8781-014a90c8abf1 Cherry-picked-from: 5f5d5ea Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e251dc82-658d-4b6e-a4df-cc4af1e7d408 * Speed up CLI argument escaping tests (#1773) Copilot-Session: 323a2062-9493-4be4-a710-f6c2b9e15a49 Cherry-picked-from: 155f619 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e251dc82-658d-4b6e-a4df-cc4af1e7d408 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Jeff Handley <jeffhandley@users.noreply.github.com> Co-authored-by: Pranav Senthilnathan <pranas@microsoft.com> Copilot-Session: e251dc82-658d-4b6e-a4df-cc4af1e7d408 Copilot-Session: ad8afb00-2809-4785-8781-014a90c8abf1 Copilot-Session: 323a2062-9493-4be4-a710-f6c2b9e15a49
jeffhandley
added a commit
that referenced
this pull request
Nov 3, 2026
* Require stable identities for authenticated HTTP sessions Fail closed when authenticated stateful Streamable HTTP or legacy SSE users lack a non-empty NameIdentifier, sub, or UPN claim. Consider all authenticated identities, ignore unauthenticated ownership claims, and preserve claim precedence and type/value/issuer binding. Carry the captured identity through session creation and migration, forward the original authenticated principal, and document IClaimsTransformation for custom identifiers. Cover anonymous-owned session protection, secondary identities, ownership isolation, principal propagation, and migration snapshots with SDK regressions. Squashes the canonical advisory implementation through 44efea55326e791983fa87901f5ad3356d671e0c plus reviewed claim-lookup and test cleanup. Original source fix: bd3b432b3b457da6073b66e5d375eba983aa0bed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> (cherry picked from commit 576fe7a0abad7555fae0cdc498a6f78b502fc433) * Simplify the claims transformation documentation example Show the agreed single-identity custom-user-id mapping with a NameIdentifier idempotency guard and preserved claim issuer. Keep the authentication setup guidance and runtime identity requirements unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> (cherry picked from commit 165b701247d6aed69743d043bb309474762524ad) * Fix enterprise-managed authorization documentation link Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e251dc82-658d-4b6e-a4df-cc4af1e7d408 * Align enterprise authorization spec link with main Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e251dc82-658d-4b6e-a4df-cc4af1e7d408 * Resolve test server paths deterministically (#1735) Copilot-Session: ad8afb00-2809-4785-8781-014a90c8abf1 Cherry-picked-from: 5f5d5ea Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e251dc82-658d-4b6e-a4df-cc4af1e7d408 * Speed up CLI argument escaping tests (#1773) Copilot-Session: 323a2062-9493-4be4-a710-f6c2b9e15a49 Cherry-picked-from: 155f619 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e251dc82-658d-4b6e-a4df-cc4af1e7d408 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Jeff Handley <jeffhandley@users.noreply.github.com> Co-authored-by: Pranav Senthilnathan <pranas@microsoft.com> Copilot-Session: e251dc82-658d-4b6e-a4df-cc4af1e7d408 Copilot-Session: ad8afb00-2809-4785-8781-014a90c8abf1 Copilot-Session: 323a2062-9493-4be4-a710-f6c2b9e15a49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
TestServer.exeandTestServer.dllfromAppContext.BaseDirectorydotnetinvocation behaviorPATHValidation
dotnet test .\tests\ModelContextProtocol.Tests\ModelContextProtocol.Tests.csproj --framework net10.0 --filter "FullyQualifiedName~ModelContextProtocol.Tests.Transport.StdioClientTransportTests.EscapesCliArgumentsCorrectly|FullyQualifiedName~ModelContextProtocol.Tests.ClientIntegrationTests"(99 total: 97 passed, 2 skipped)dotnet build(succeeded with 0 warnings and 0 errors)dotnet test --no-build(rerun passed all projects/frameworks except one unrelated net9 cancellation race; the single failed test passed immediately in isolation)