Session Id Management Best Practices For MCP Servers

[aradyaron]

Pre-submission Checklist

• I have checked that this question would not be more appropriate as an issue in a specific repository
• I have searched existing discussions and documentation for answers

Question Category

• Protocol Specification
• SDK Usage
• Server Implementation
• General Implementation
• Documentation
• Other

Your Question

Relations between incoming Requesting User and MCP Session Id

As far as I checked, the standard does not specify if a single MCP Session Id can only serve a single user.
Additionally a User may have multiple authorization tokens, either in the same time, or regenerated due to expiration.

1. Should the specification add a requirement that a single MCP Session MUST Serve only a single User?
2. If this is not a requirement, but for security purposes it is a requirement, what's the expected behavior from the server?
3. What are the best practices for the relations between the different incoming Authorization Tokens and the MCP Session id? Note that a single Client may use the same session with different authorization tokens at the same time according to the current standard.