From 2d08ecf6b90896d623cfb0f5809cf3f5b32dbb08 Mon Sep 17 00:00:00 2001 From: Daniel Kristiansen Date: Wed, 2 Sep 2026 12:34:35 +0200 Subject: [PATCH 1/2] ci(codeql): exclude ContractApi test fixture from alerts --- .github/codeql/codeql-config.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml index 14a2a71..6e8fea1 100644 --- a/.github/codeql/codeql-config.yml +++ b/.github/codeql/codeql-config.yml @@ -3,3 +3,7 @@ name: "JsonApiToolkit CodeQL" paths-ignore: - "**/bin/**" - "**/obj/**" + # Localhost-only contract-test fixture with in-memory seeded data. + # Not deployed and not a usage showcase, so auth alerts on it are noise. + # Authentication and authorization belong to the consuming application. + - "samples/ContractApi/**" From 8e5449ce284b367e72425b7e12484c38ee2d8b39 Mon Sep 17 00:00:00 2001 From: Daniel Kristiansen Date: Wed, 2 Sep 2026 12:34:35 +0200 Subject: [PATCH 2/2] docs(security): state that auth is the consuming app's responsibility --- docs/security.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/security.md b/docs/security.md index fce8630..14e0518 100644 --- a/docs/security.md +++ b/docs/security.md @@ -5,6 +5,9 @@ Guidance for using JsonApiToolkit safely: restricting includes, configuring quer > [!NOTE] > To **report a vulnerability** in JsonApiToolkit itself, see the [Security Policy](https://github.com/intility/json-api-toolkit/blob/main/SECURITY.md). This page is about using the toolkit securely. +> [!NOTE] +> JsonApiToolkit does not perform authentication or authorization. It builds queries and serializes responses inside your controllers. Protecting endpoints with `[Authorize]`, policies, and per-resource ownership checks is the responsibility of the consuming application. + ## `[AllowedIncludes]` Without `[AllowedIncludes]`, every navigation property on your entities is includable via `?include=`. That can leak sensitive relationships and run expensive queries. The attribute restricts which relationships clients can request.