Reason for Checking `msg.sender == _msgSender()` in OpenZeppelin's MulticallUpgradeable Contract

Question

In the OpenZeppelin::MulticallUpgradeable contract, there's a validation that checks msg.sender == _msgSender(). Considering that msg.sender and _msgSender() typically return the same value, why is this validation necessary? Are there any scenarios where this equality might not hold? What's the non-canonical contexts (i.e. msg.sender is not {_msgSender})?

    function multicall(bytes[] calldata data) external virtual returns (bytes[] memory results) {
@>      bytes memory context = msg.sender == _msgSender()
            ? new bytes(0)
            : msg.data[msg.data.length - _contextSuffixLength():];

        results = new bytes[](data.length);
        for (uint256 i = 0; i < data.length; i++) {
            results[i] = AddressUpgradeable.functionDelegateCall(address(this), bytes.concat(data[i], context));
        }
        return results;
    }

Answer 1

In OpenZeppelin's MulticallUpgradeable contract, the msg.sender == _msgSender() check is essential to prevent relayers from manipulating context data in meta-transaction scenarios. _msgSender() returns the actual user's address, even in meta-transactions, while msg.sender is the relayer's address. This check ensures that only the intended user can provide context data, safeguarding the contract's security.