Security context

Highlights

Auth Bypass: 13 prior fixes. Scrutinize any change in this area.

src/client/auth.ts: most-fixed (4 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Placeholder token exchange logic and missing or bypassed PKCE (Proof Key for Code Exchange) validation allowed authentication bypasses because verification was delegated incorrectly to upstream providers without passing the necessary verifiers.

Auth Bypass: Tokens without explicit expiration properties (undefined, null, or NaN) bypass expiration checks and remain valid indefinitely unless the middleware explicitly validates both the presence and valid bounds of the 'expiresAt' field.

Auth Bypass: Improper path prefix matching on URL checks allowed subpaths without trailing slashes (such as matching /api123 to /api) to bypass authorization boundaries unless paths are properly canonicalized first.