Security context

Highlights

Auth Bypass: 18 prior fixes. Scrutinize any change in this area.

src/HotChocolate/Core/src/Authorization/AuthorizationTypeInterceptor.cs: most-fixed (2 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: The GraphQL schema construction interceptor historically skipped or incorrectly cast authorization directives during construction, and failed to correctly apply metadata-level authorization to nested node resolvers. This allows resolvers to execute without triggering the configured security middleware.

Auth Bypass: Caching of authorization validation rules across requests can cause subsequent unauthorized users to bypass security checks if a prior authorized request's validation state is reused.

Auth Bypass: Misalignments between the query validation phase and field resolver phase can lead to authorization bypasses if 'ApplyPolicy.Validation' rules are skipped or registered at the wrong time (e.g. executing resolvers before validating access).