Add public method to bypass Zen for a request - #1128
Conversation
![aikido-pr-checks[bot]](https://avatars.github.com/in/898896?s=60&v=4){kind=small}
| return; | ||
| } | ||
|
|
||
| context.bypassRequest = true; |
There was a problem hiding this comment.
🟡 Medium - Request bypass state escapes the request and disables protection in background async work
bypassRequest() stores the bypass flag on the shared AsyncLocalStorage request context, so every async resource created during that request inherits the flag as well. runWithContext does not clear that state when the HTTP response finishes, and the existing context tests show timers keep the request context after the handler returns. As a result, queued work such as setTimeout, promise continuations, or post-response tasks spawned from a bypassed request will also skip Zen's blocking and detection logic, extending the bypass far beyond the single request the API claims to affect.
Show fix
Scope bypassing to an explicit callback or clear the bypass state when the response lifecycle ends, so detached async work does not inherit it. If background work must be supported, use a separate AsyncLocalStorage scope for withBypassedProtection(fn) instead of persisting the flag on the request context object.
More info - Reply on this comment to give feedback or ignore the issue.
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
| // ... | ||
| ``` | ||
|
|
||
| Please use this feature with caution, as it can potentially expose your application to security risks if not used properly. |
There was a problem hiding this comment.
use github warning? to make this a bit more screamy?
3 participants
No description provided.