Security context

Highlights

Auth Bypass: 25 prior fixes. Scrutinize any change in this area.

src/main/java/io/supertokens/session/Session.java: most-fixed (4 issues). Treat as high-risk during review.

19 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: A simple parameter order mismatch during a method invocation in VerifySessionAPI accidentally disabled Anti-CSRF verification checks, creating a major bypass. Strict type-safe parameters or explicit builder patterns should be used for validation calls.

Auth Bypass: Session payloads were vulnerable to tampering where clients could inject protected JWT claims (such as sub, exp, or iat) during payload updates. The fix explicitly rejects protected keys from the user payload during updates.

Auth Bypass: The lack of rigid validation on tenant identifiers allowed cross-tenant administrative actions, including unauthorized deletion or configuration modifications. Admin actions must explicitly assert permissions on the default public tenant.