>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3579982. --> Reported by: [scott_euser](https://www.drupal.org/user/3267594) Related to !47 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>DisallowMcpAuthRequests::isMcpRequest() returns FALSE for all /mcp requests when authentication is disabled because it requires both authIsEnabled() and a Basic auth header. As a result, Drupal's page cache serves cached HTML responses (e.g. 403 pages) to MCP clients instead of JSON. </p> <p>Additionally, McpAuthProvider::applies() calls the same isMcpRequest() method, so any fix to that method for page cache purposes would incorrectly cause the auth provider to attempt authentication on all /mcp requests, throwing a 403 when no Authorization header is present.</p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <ol> <li>Disable MCP authentication at /admin/config/mcp and ensure that anonymous users have permission to use MCP Server (of course disabling any sensitive plugins or restricting them to specific roles)</li> <li>POST to /mcp/post without a Cache-Control: no-cache header (which is e.g. what Claude Connnectors will do) </li> <li>First request may succeed; subsequent requests return cached HTML </li> </ol> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Split isMcpRequest() into two methods: </p> <ol> <li>isMcpRequest() &mdash; path check only (str_starts_with('/mcp')), used by page cache policy to deny caching for all MCP requests regardless of auth state </li> <li>isMcpAuthRequest() &mdash; path + auth enabled + Basic header present, used by McpAuthProvider::applies() </li> </ol> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <p>Merge request</p> <h3 id="summary-ui-changes">User interface changes</h3> <p>N/A</p> <h3 id="summary-api-changes">API changes</h3> <p>N/A</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>N/A</p>