Security context

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

src/lib/server/auth.ts: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Insecure cookie parsing and session state handling allowed users to bypass authentication or cause crashes. Specifically, parsing unvalidated cookie strings like 'undefined' and failing to require both session and metadata cookies created exploitable gaps in authentication checks.

Auth Bypass: Lack of centralized, route-level authorization guards allowed unauthenticated users to access account management and profile routes, requiring the manual insertion of redirect logic.

Auth Bypass: Failure to properly invalidate and clear session identifiers (sid) and user metadata cookies during the logout process left sessions active and vulnerable to session hijacking.