column-mask-reapply-on-cached-results

Column masks are re-applied on cached Cube query results as a defense-in-depth layer. This ensures role revocations take effect immediately even when the underlying Cube result is served from cache, preventing stale privilege escalation. The mask application at the widget-data layer is intentionally redundant with DB-level masks.

Related

• column-masks-reapplied-on-cached-results-defense-in-depth
• vantage-rbac-rls-non-negotiable-v1-gate
• cube-query-uses-5min-hs256-jwt-with-security-context
• rbac-rls-at-query-execution-layer-is-non-negotiable-enterpri
• snowflake
• cubejs-jwt-hs256-5min-exp-issuer-locked-security-context
• cube-query-cache-column-masks-reapplied-on-cache-hit
• column-masks-reapplied-on-cached-results-for-immediate-revoc
• column-masks-reapplied-post-cache-for-immediate-role-revocat
• cube-js-jwt-dev-fallback-key-is-publicly-known
• column-mask-reapplication-on-cached-query-results
• column-masks-reapplied-post-cache-defense-in-depth