Security context

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

src/Ocelot/Authorisation/Middleware/AuthorisationMiddleware.cs: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: The authorization engine previously retrieved only the first claim value of a matching type, allowing clients with multiple claims to bypass intended permission policies. Claims parsing must iterate through and validate all present claims of a given type.

Auth Bypass: During HTTP request multiplexing, the security context (User principal) was previously lost, leading to downstream requests executing without authentication claims. When requests are cloned or multiplexed, security contexts must be explicitly propagated.

Improper Certificate Validation: The WebSocket proxy bypasses explicit security configurations like 'DangerousAcceptAnyServerCertificateValidator' defined on downstream routes, exposing connections to potential man-in-the-middle attacks. WebSocket connection setups must actively forward validation callback policies.