Deprecate Builder.customizeRequest() in favor of httpRequestCustomizer()#791
Merged
Kehrlann merged 5 commits intomodelcontextprotocol:mainfrom Apr 2, 2026
Merged
Conversation
gyeo009
force-pushed
the
deprecate-customizeRequest
branch
from
096f8c3 to
c5a3662
Compare
Kehrlann
force-pushed
the
deprecate-customizeRequest
branch
from
c5a3662 to
7449f2a
Compare
Contributor
|
@gyeo009 thank you for your contribution. I agree that this should be deprecated. |
Kehrlann
added
waiting for user
Kehrlann
requested changes
Mar 3, 2026
Contributor
Kehrlann
left a comment
Kehrlann
left a comment
There was a problem hiding this comment.
Please update the Javadoc to point to HttpClientStreamableHttpTransport.Builder.requestBuilder(HttpRequest.Builder) in case users want to specify "stable" headers that are applied to every request. (and same for SSE)
gyeo009
force-pushed
the
deprecate-customizeRequest
branch
4 times, most recently
from
4cddda2 to
a3b0cfa
Compare
Contributor
Author
|
Kehrlann
previously approved these changes
Apr 2, 2026
…and HttpClientStreamableHttpTransport customizeRequest() executes its consumer once at build time, freezing headers into the shared requestBuilder. This silently breaks OAuth token refresh scenarios where the Authorization header needs to be updated after the transport is built. Add @deprecated and update Javadoc to clarify the build-time-only semantics and guide users toward httpRequestCustomizer() or asyncHttpRequestCustomizer() which run on every request. Closes modelcontextprotocol#788
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
Kehrlann
force-pushed
the
deprecate-customizeRequest
branch
from
755404e to
ec6393b
Compare
Kehrlann
added
area/client
and removed
waiting for user
Kehrlann
approved these changes
Apr 2, 2026
Kehrlann
pushed a commit
that referenced
this pull request
Apr 2, 2026
…r() (#791) Deprecate Builder.customizeRequest() in HttpClientSseClientTransport and HttpClientStreamableHttpTransport customizeRequest() executes its consumer once at build time, freezing headers into the shared requestBuilder. This silently breaks OAuth token refresh scenarios where the Authorization header needs to be updated after the transport is built. Add @deprecated and update Javadoc to clarify the build-time-only semantics and guide users toward httpRequestCustomizer() or asyncHttpRequestCustomizer() which run on every request. Closes #788 Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
Contributor
|
Backported to 1.1.x through 7e4c179 |
Contributor
|
Thank you for your contribution! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
Builder.customizeRequest()inHttpClientSseClientTransportandHttpClientStreamableHttpTransportexecutes its consumer once at build time, mutating the sharedrequestBuilder. Any headers set here (e.g.,Authorization) are frozen into the template and copied to every subsequent request viarequestBuilder.copy().This silently breaks OAuth token refresh scenarios: after refreshing an access token, the transport continues sending the old expired token because the header was baked in at construction time.
The method name
customizeRequeststrongly suggests per-request behavior, making it easy to use incorrectly. The correct alternatives —httpRequestCustomizer()andasyncHttpRequestCustomizer()— already exist and run on every request, but there is no deprecation notice or Javadoc warning guiding users toward them.We encountered this in production where our MCP connector's OAuth token refresh was completely non-functional due to this behavior.
Changes
@DeprecatedtocustomizeRequest()in bothHttpClientSseClientTransport.BuilderandHttpClientStreamableHttpTransport.BuilderhttpRequestCustomizer()/asyncHttpRequestCustomizer()as the per-request alternativesHow Has This Been Tested?
This is a Javadoc + annotation-only change. Verified compilation passes with
spring-javaformat:applyandmvn compile.Breaking Changes
None. This only adds a deprecation warning — no behavioral changes.
Types of changes
Checklist
Additional context
Closes #788