Skip to content

Comments

fix: add header normalization middleware to resolve Mixed Auth publis…#188

Open
ArsalanShakil wants to merge 1 commit intoopenai:mainfrom
ArsalanShakil:fix/mixed-auth-mcp-header-normalization
Open

fix: add header normalization middleware to resolve Mixed Auth publis…#188
ArsalanShakil wants to merge 1 commit intoopenai:mainfrom
ArsalanShakil:fix/mixed-auth-mcp-header-normalization

Conversation

@ArsalanShakil
Copy link

…hing errors

Resolves #183

The MCP SDK strictly validates Content-Type and Accept headers, rejecting:

  • Content-Type: text/octet-stream (returns 400 Bad Request)
  • Accept: / (returns 406 Not Acceptable)

This caused app publishing to fail when using Mixed Auth mode because the OpenAI platform sends POST /mcp requests with non-standard headers during tool scanning.

This commit adds an ASGI middleware (MCPHeaderNormalizationMiddleware) to all Python servers that normalizes headers before they reach the MCP SDK:

  • Rewrites text/octet-stream to application/json
  • Adds explicit application/json to wildcard Accept headers
  • Adds default Content-Type and Accept headers when missing

…hing errors

Resolves openai#183

The MCP SDK strictly validates Content-Type and Accept headers, rejecting:
- Content-Type: text/octet-stream (returns 400 Bad Request)
- Accept: */* (returns 406 Not Acceptable)

This caused app publishing to fail when using Mixed Auth mode because the
OpenAI platform sends POST /mcp requests with non-standard headers during
tool scanning.

This commit adds an ASGI middleware (MCPHeaderNormalizationMiddleware) to all
Python servers that normalizes headers before they reach the MCP SDK:
- Rewrites text/octet-stream to application/json
- Adds explicit application/json to wildcard Accept headers
- Adds default Content-Type and Accept headers when missing
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: Mixed Auth fails when publishing app (406 / 400 on /mcp)

2 participants