Skip to content

docs(mcp): clarify unsigned session token trust #1151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marandaneto merged 1 commit into from
Nov 2, 2026
Merged

docs(mcp): clarify unsigned session token trust #1151

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions posthog/mcp/session_token.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,9 @@
So at ``initialize`` we mint that header as a token carrying the session id and
client identity -- any pod can read them back from the header alone.

The token is unsigned: it holds only what the client already self-reports. It is
wire-compatible with the TypeScript SDK (same short keys ``sid``/``cn``/``cv``/``pv``),
The token is unsigned, so clients can change its contents. Use decoded values
for analytics, not authentication or authorization. It is wire-compatible with
the TypeScript SDK (same short keys ``sid``/``cn``/``cv``/``pv``),
so a token minted by one SDK decodes in the other.
"""

Expand Down
Loading