Client continuously sends requests after server restart, causing 401 Unauthorized

Bắt đầu bằng cách tái hiện sự cố với npm run dev:with-separate-auth, sau đó kiểm tra yêu cầu MCP, việc xác thực và xử lý phiên được thể hiện trong log. Xác minh hành vi sau khi khởi động lại máy chủ, bao gồm phiên không hợp lệ và các phản hồi 401 lặp lại; được xem là hoàn tất khi client làm mới hoặc thiết lập lại một phiên hợp lệ thay vì tiếp tục thử lại cho đến khi bị giới hạn tốc độ.

Describe the bug
When running mcp-server and auth-server with npm run dev:with-separate-auth, the connection works successfully at first. However, after the server restarts, the client (Cursor) keeps sending repeated requests to the mcp-server and receives 401 Unauthorized responses. Once the server replies with Too Many Requests, the requests stop.

To Reproduce
Steps to reproduce the behavior:

Start mcp-server and auth-server with npm run dev:with-separate-auth.

Confirm that the connection is established successfully.

Restart the server.

Observe that the client (Cursor) keeps sending requests to the mcp-server, resulting in 401 Unauthorized responses until the server eventually responds with Too Many Requests.

Expected behavior
After the server restarts, the client should refresh/re-establish a valid session/token instead of continuously sending unauthorized requests.

Logs
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/.well-known/oauth-protected-resource/mcp","headers":{"user-agent":"node","mcp-protocol-version":"2025-06-18","accept":"/"},"userAgent":"node","path":"/.well-known/oauth-protected-resource/mcp","msg":"Request received","time":"2025-09-30T07:49:01.729Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/.well-known/oauth-protected-resource/mcp","statusCode":404,"duration":"1ms","userAgent":"node","path":"/.well-known/oauth-protected-resource/mcp","msg":"Request completed","time":"2025-09-30T07:49:01.730Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/.well-known/oauth-protected-resource","headers":{"user-agent":"node","mcp-protocol-version":"2025-06-18","accept":"/"},"userAgent":"node","path":"/.well-known/oauth-protected-resource","msg":"Request received","time":"2025-09-30T07:49:01.731Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/","statusCode":200,"duration":"0ms","userAgent":"node","path":"/.well-known/oauth-protected-resource","msg":"Request completed","time":"2025-09-30T07:49:01.731Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/mcp","headers":{"user-agent":"Cursor/1.7.17 (darwin arm64)","mcp-protocol-version":"2025-06-18","mcp-session-id":"bb9e7729-527a-41bf-8176-47079a0364a6","accept":"text/event-stream"},"userAgent":"Cursor/1.7.17 (darwin arm64)","path":"/mcp","msg":"Request received","time":"2025-09-30T07:49:01.743Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":20,"token":"b99bfaf8...","cacheDuration":"60s","userAgent":"Cursor/1.7.17 (darwin arm64)","method":"GET","path":"/mcp","msg":"Token validation cached","time":"2025-09-30T07:49:01.747Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":20,"method":"GET","sessionId":"bb9e7729-527a-41bf-8176-47079a0364a6","userId":"47548bff-02ad-44ec-a6fc-25fc7bb925a7","hasAuth":true,"authExtra":{"userId":"47548bff-02ad-44ec-a6fc-25fc7bb925a7","iss":"http://localhost:3001","aud":"http://localhost:3232"},"userAgent":"Cursor/1.7.17 (darwin arm64)","path":"/mcp","msg":"SHTTP request received","time":"2025-09-30T07:49:01.749Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":20,"sessionId":"bb9e7729-527a-41bf-8176-47079a0364a6","userAgent":"Cursor/1.7.17 (darwin arm64)","method":"GET","path":"/mcp","msg":"Session not live","time":"2025-09-30T07:49:01.749Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":40,"sessionId":"bb9e7729-527a-41bf-8176-47079a0364a6","userId":"47548bff-02ad-44ec-a6fc-25fc7bb925a7","requestMethod":"GET","userAgent":"Cursor/1.7.17 (darwin arm64)","method":"GET","path":"/mcp","msg":"Session ownership mismatch","time":"2025-09-30T07:49:01.749Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/mcp","statusCode":401,"duration":"7ms","userAgent":"Cursor/1.7.17 (darwin arm64)","path":"/mcp","msg":"Request completed","time":"2025-09-30T07:49:01.750Z","v":0}

Additional context

This issue only happens after a server restart. The initial connection works without issues.

The client is Cursor, which connects to the mcp-server.