tRPC Unsafe Context Usage

Description

Using unvalidated headers, cookies, or query params in context creation allows attackers to bypass authentication and impersonate users.

What Shoulder detects

Context creation uses raw request data without validation. Verify and validate all request data before adding to context.

How to fix

Verify JWT signatures or use session libraries instead of trusting raw headers.

```typescript
import { getServerSession } from 'next-auth';

export async function createContext({ req, res }: CreateNextContextOptions) {
  const session = await getServerSession(req, res, authOptions);
  return {
    user: session?.user ?? null,
    db
  };
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/context-injection