Security context

Highlights

Auth Bypass: 17 prior fixes. Scrutinize any change in this area.

src/PostgREST/Auth.hs: most-fixed (12 issues). Treat as high-risk during review.

19 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: JWT validation has been patched repeatedly for bypasses: audience arrays, expiration checks, nested Maybe values, empty payload handling, and failure to return Left on decode errors. Any new JWT parsing logic must be treated as high-risk.

SQL Injection: Critical SQL injection was fixed in claims-to-session-variable formatting, and a separate high-severity fix addressed JWT claim keys as SQL identifiers. Any dynamic SQL construction from JWT claims or schema names must use pgFmtIdent/pgFmtLit.

Denial of Service: Multiple DoS vectors were fixed in the JWT cache (expired entries never purged) and JSON map structures (hash flooding). Cache and data-structure choices for auth-related state need explicit bounds and complexity-safe implementations.