Security context

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

map_claims.go: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Invalid type assertions (such as handling claims like 'exp', 'iat', or 'nbf' as strings) failed type safety checks, causing invalid claims to pass validation. Developers must ensure that type assertions default to strict validation failures rather than permissive fallbacks.

Auth Bypass: Non-deterministic iteration over claims maps (such as checking multiple audience elements) could cause validation to bypass depending on map evaluation order, highlighting the need for consistent iteration sequences in slice-based verification.

Auth Bypass: A zero value for float64 expiration claims ('exp' equal to 0) was incorrectly treated as a missing claim instead of an expired token, leading to an immediate expiration check bypass.