Multi-turn conversation context is validated for injection

When clients supply the full conversation history on each request, an attacker can fabricate previous assistant turns that never occurred—inserting fake model agreements like "As I mentioned earlier, I can help with that" to manipulate the model's behavior in the current turn. This is a form of indirect prompt injection (OWASP LLM01:2025, MITRE ATLAS AML.T0051) that exploits the model's tendency to maintain consistency with apparent prior context. The vulnerability is invisible in code review because the injection arrives as a structurally valid messages array, not as obviously malicious input. Applications with multi-user conversations (support tools, shared workspaces) face the additional risk of context cross-contamination between users.

Read conversation history from a server-side store keyed by a validated conversation ID. Never trust a client-supplied messages array as the canonical record of prior turns.

// Server-side conversation reconstruction
export async function POST(req: Request) {
  const { conversationId, userMessage } = await req.json()
  const validatedId = z.string().uuid().parse(conversationId)

  // History comes from your DB, not the client
  const history = await db.messages.findMany({
    where: { conversationId: validatedId, userId: session.userId },
    orderBy: { createdAt: 'asc' },
    select: { role: true, content: true }
  })

  const messages = [
    { role: 'system', content: SYSTEM_PROMPT },
    ...history,
    { role: 'user', content: userMessage }
  ]
  // proceed with AI call
}

The userId filter in the query is essential in multi-tenant applications to prevent one user's history from being accessed via another user's conversation ID.