fix: Add null check for session in WebFluxSseServerTransportProvider (modelcontextprotocol#138)

Add error handling to return a 404 NOT_FOUND response when a request
is made with a non-existent session ID. This prevents potential
NullPointerExceptions when processing requests with invalid session IDs.

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>

Author: tzolov

mcp-spring/mcp-spring-webflux/src/main/java/io/modelcontextprotocol/server/transport/WebFluxSseServerTransportProvider.java

@@ -306,6 +306,11 @@ private Mono<ServerResponse> handleMessage(ServerRequest request) {
 
 		McpServerSession session = sessions.get(request.queryParam("sessionId").get());
 
+		if (session == null) {
+			return ServerResponse.status(HttpStatus.NOT_FOUND)
+				.bodyValue(new McpError("Session not found: " + request.queryParam("sessionId").get()));
+		}
+
 		return request.bodyToMono(String.class).flatMap(body -> {
 			try {
 				McpSchema.JSONRPCMessage message = McpSchema.deserializeJsonRpcMessage(objectMapper, body);