Security context

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

lib/warden/proxy.rb: most-fixed (3 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Warden's user resolution logic previously considered a strategy successful merely because a user attribute was populated, ignoring explicit failure statuses in the strategy execution. This bypasses authentication rules entirely for failed attempts that still register user references.

Auth Bypass: A successful strategy outcome from a prior scope evaluation could persist across evaluations, inadvertently validating subsequent scopes that should otherwise fail.

Auth Bypass: The lack of enforcement of individual strategy storage preferences could allow single-request or temporary strategies to write credentials or user structures to persistent session storage.