Security context

Highlights

Auth Bypass: 21 prior fixes. Scrutinize any change in this area.

lib/connect/middleware/session.js: most-fixed (12 issues). Treat as high-risk during review.

24 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: The cookie-based session middleware historically relied on CRC32 hashing to check if sessions were modified. Because CRC32 is highly susceptible to collision attacks, this allowed malicious actors to construct tampered payloads that bypassed integrity checks. Later fixes corrected this by replacing the CRC32 check with full string and signature validations.

CSRF: Connect utilized custom, static session-based CSRF token generation that was vulnerable to token disclosure and BREACH side-channel attacks. The project ultimately retired the custom implementation in favor of the standardized 'csurf' package and salted, HMAC-based tokens.

Denial of Service: Multipart and JSON body parsers lacked default request size limitations, allowing remote attackers to exhaust server memory and cause persistent hangs. The fix introduced strict default limits (e.g., 1MB for JSON/urlencoded and 100MB for multipart) to safeguard system memory.