[Server] Stop a claim that is not UTF-8 from failing the session principal

Author: chr-hertel

src/Server/Authorization/AccessToken.php

@@ -11,8 +11,6 @@
 
 namespace Mcp\Server\Authorization;
 
-use Mcp\Exception\RuntimeException;
-
 /**
  * The validated access token a request was authorized with.
  *
@@ -85,18 +83,12 @@ public function getClientId(): ?string
 
     /**
      * Who the token identifies: its issuer, client and subject, which outlive a token refresh.
-     *
-     * @throws RuntimeException when a claim cannot be encoded
      */
     public function getPrincipal(): string
     {
         $issuer = $this->getClaim('iss');
 
-        try {
-            return json_encode([\is_string($issuer) ? $issuer : null, $this->getClientId(), $this->getSubject()], \JSON_THROW_ON_ERROR);
-        } catch (\JsonException $e) {
-            throw new RuntimeException(\sprintf('Failed to encode the principal of an access token as JSON: %s', $e->getMessage()), previous: $e);
-        }
+        return serialize([\is_string($issuer) ? $issuer : null, $this->getClientId(), $this->getSubject()]);
     }
 
     /**

tests/Unit/Server/Authorization/AccessTokenTest.php

@@ -11,7 +11,6 @@
 
 namespace Mcp\Tests\Unit\Server\Authorization;
 
-use Mcp\Exception\RuntimeException;
 use Mcp\Server\Authorization\AccessToken;
 use PHPUnit\Framework\TestCase;
 
@@ -60,11 +59,12 @@ public function testPrincipalKeepsClaimsApart(): void
         );
     }
 
-    public function testPrincipalOfAClaimThatCannotBeEncodedFails(): void
+    public function testPrincipalKeepsClaimsThatAreNotUtf8Apart(): void
     {
-        $this->expectException(RuntimeException::class);
-
-        (new AccessToken([], ['sub' => "\xB1"]))->getPrincipal();
+        $this->assertNotSame(
+            (new AccessToken([], ['sub' => "\xB1"]))->getPrincipal(),
+            (new AccessToken([], ['sub' => "\xB2"]))->getPrincipal(),
+        );
     }
 
     public function testIsNeverSerialized(): void

tests/Unit/Server/Transport/SessionBindingTest.php

@@ -198,6 +198,19 @@ public function testTokensWithoutSubjectOfAnotherClientAreRefused(): void
         $this->assertSame(404, $this->callWith($session, [AccessToken::class => new AccessToken([], ['client_id' => 'b'])])->getStatusCode());
     }
 
+    public function testTokenWithAClaimThatIsNotUtf8BindsTheSession(): void
+    {
+        $owner = [AccessToken::class => new AccessToken([], ['sub' => "\xB1"])];
+        $other = [AccessToken::class => new AccessToken([], ['sub' => "\xB2"])];
+        $ping = '{"jsonrpc":"2.0","id":2,"method":"ping"}';
+        $session = $this->openWith($owner);
+
+        $this->assertSame(200, $this->serveWith($this->request('POST', $ping, null, $session), $owner)->getStatusCode());
+        $this->assertSame(404, $this->serveWith($this->request('POST', $ping, null, $session), $other)->getStatusCode());
+        $this->assertSame(404, $this->serveWith($this->request('DELETE', '', null, $session), $other)->getStatusCode());
+        $this->assertSame(200, $this->serveWith($this->request('DELETE', '', null, $session), $owner)->getStatusCode());
+    }
+
     public function testTokenWithoutClaimsDoesNotShareSessionsWithRequestsWithoutToken(): void
     {
         $session = $this->openWith([AccessToken::class => new AccessToken()]);