- The middleware pipeline calls `UseAuthorization()` BEFORE `UseAuthentication()`.
- A JWT-looking value (header `eyJ…`) appears in a URL query string or fragment.
- OAuth implicit flow is deprecated by the OAuth 2.0 Security BCP (RFC 9700) and the OAuth 2.1 draft.
- OAuth 2.0 authorization request is being built WITHOUT a `state` parameter.
- The OAuth callback handler redirects to a URL taken straight from the request without validating it.
- OAuth `redirect_uri` allow-list contains a wildcard, an `http://` URL, or `localhost`.
- A session token / id appears in a URL query string.
- OAuth authorization request is built with a hardcoded, constant `state` value.
- OAuth authorization request sends a hardcoded, constant `state` value.
- OAuth authorization request from a public client omits the PKCE `code_challenge` parameter.
- OAuth callback handler reads `state` from the request but never compares it to a stored value.
- OAuth authorization request sends a hardcoded, constant `state` value.
- OAuth authorization request sends a hardcoded, constant `state` value.
- OAuth authorization request is built with a hardcoded, constant `state` value (`CsrfToken::new("literal")`).
- OAuth scope request includes an over-broad scope such as `admin`, `full_access`, `*`, or `repo` (entire GitHub access).
OWASP COVERAGE
Mapped to the risks that matter.
Every OAuthLint rule maps to an OWASP risk. This page is built from the shipped rule pack, so it shows exactly which OWASP API Security and Web Application Top 10 categories the rules cover, and which auth anti-patterns sit under each.
11
OWASP categories covered
281
rules mapped to a risk
2
OWASP editions
API SECURITY TOP 10 · 2023
- A JWT signing key is built from a hard-coded string literal (`new SymmetricSecurityKey(Encoding.UTF8.GetBytes("..."))`).
- A JWT setup sets `RequireSignedTokens = false` on `TokenValidationParameters`.
- A custom `SignatureValidator` on `TokenValidationParameters` returns a parsed token WITHOUT verifying its signature: it just constructs and returns `new JwtSecurityToken(token)` / `new JsonWebToken(token)`.
- A JWT bearer setup disables audience validation (`ValidateAudience = false`) on `TokenValidationParameters`.
- A JWT bearer setup disables issuer validation (`ValidateIssuer = false`) on `TokenValidationParameters`.
- A JWT bearer setup disables lifetime validation (`ValidateLifetime = false`) on `TokenValidationParameters`.
- A JWT bearer setup disables signature validation (`ValidateIssuerSigningKey = false`) on `TokenValidationParameters`.
- An OAuth/OIDC client secret is assigned from a hard-coded string literal (`options.ClientSecret = "..."`).
- An OpenID Connect handler turns PKCE off (`UsePkce = false`).
- `@fastify/jwt` is registered with a hard-coded `secret` string literal.
- A secret credential is placed in a URL query string.
- `Math.random()` produces a value whose name marks it as security-sensitive.
- A user-supplied password is being persisted WITHOUT being hashed first.
- The Echo JWT middleware (`labstack/echo-jwt`) is configured with a hardcoded string-literal `SigningKey`.
- The Fiber JWT middleware (`gofiber/contrib/jwt`) is configured with a hardcoded string-literal signing key (`SigningKey: jwtware.SigningKey{Key: []byte("...")}`).
- A JWT HMAC signing/verification key is hardcoded as a string literal in a call to golang-jwt.
- A JWT is created or accepted with the `none` algorithm, which produces an unsigned token.
- A JWT is decoded with `ParseUnverified`, which parses the token WITHOUT checking its signature.
- A JWT `Keyfunc` returns the verification key without checking `token.Method`, enabling algorithm confusion.
- Untrusted request input flows into the verification key returned by a `golang-jwt` `Keyfunc` (or into the `WithValidMethods` allowlist).
- An `oauth2.Config` is built with a hardcoded string-literal `ClientSecret`.
- OAuth token request uses the Resource Owner Password Credentials grant (`grant_type=password`).
- A gorilla/sessions or securecookie store is initialized with a hardcoded string-literal key.
- Hono's `jwt()` middleware from `hono/jwt` is configured with a hard-coded `secret` string literal.
- A JWT signing key is hard-coded as a string literal (CWE-798).
- A JWT is created or verified with the `none` algorithm, which means there is no signature at all.
- This JWT is created or parsed without a signature, so its contents are neither authenticated nor tamper-proof (CWE-347).
- Untrusted request input flows into the JWT verification key.
- OAuth token request uses the Resource Owner Password Credentials grant (`grant_type=password`).
- Spring Security session fixation protection is disabled via `sessionFixation().none()`.
- JWTs are being verified with the `none` algorithm in the allowed list.
- A JWT is being verified with HS256 (a symmetric algorithm) but the key looks like an RSA / EC public key in PEM format.
- Untrusted request input flows into the verification key or the `algorithms` allowlist of `jwt.verify(...)`.
- JWT signing or verification uses a hard-coded secret.
- An OAuth client secret / API key / password is assigned from a hard-coded string literal.
- An auth token / secret is written to plain `SharedPreferences` (`prefs.edit().putString("auth_token", ...)`).
- A JWT signer or verifier is built with `Algorithm.none()`, the unsecured algorithm that produces (and accepts) tokens with no signature.
- A JWT signing key is built from a hard-coded string literal (`Algorithm.HMAC256("...")`).
- This MCP transport is mounted on an Express route with NO auth middleware.
- A NestJS `JwtModule` is configured with a hard-coded `secret` (or `secretOrPrivateKey`) string literal.
- OAuth token request uses the Resource Owner Password Credentials grant (`grant_type=password`).
- A JWT payload is read by hand (`json_decode(base64_decode($parts[1]))` on the second dot-segment of a token) without ever verifying the signature.
- A JWT is configured with an unsecured / `none` signer, e.g. `Configuration::forUnsecuredSigner()` or `new Signer\None()` (lcobucci/jwt), or the `'none'` algorithm passed to `JWT::encode()` / `new Key(...)` (firebase/php-jwt).
- A JWT signing key is a hard-coded string literal, passed to `JWT::encode()` / `new Key()` (firebase/php-jwt) or `InMemory::plainText()` / `InMemory::base64Encoded()` (lcobucci/jwt).
- A JWT is decoded or signed with the `none` algorithm.
- A JWT is decoded with an `algorithms` allowlist that mixes an HMAC algorithm with an asymmetric one.
- A JWT signing/verification key is hardcoded as a string literal in the call to PyJWT.
- A JWT is decoded with signature verification disabled.
- Untrusted request input flows into the verification key or the `algorithms` allowlist of `jwt.decode(...)` (PyJWT / python-jose).
- This MCP server is exposed over a NETWORK transport (streamable-http / SSE) but was constructed with no authentication: no `auth=` and no `token_verifier=`.
- An OAuth client secret is passed as a string literal to the OAuth client.
- OAuth token request uses the Resource Owner Password Credentials grant (`grant_type=password`).
- A JWT is encoded or decoded with the `none` algorithm, which produces (and accepts) unsigned tokens.
- `JWT.decode` is called with its third positional argument set to `false`, which disables signature verification entirely.
- The HMAC key passed to `JWT.encode` / `JWT.decode` is a hard-coded string literal.
- A `jsonwebtoken` `Validation` accepts both HMAC and asymmetric algorithms, enabling algorithm confusion.
- `Validation::insecure_disable_signature_validation()` turns off JWT signature verification.
- A JWT HMAC signing/verification key is hardcoded as a literal.
- JWT expiration validation is turned off by setting `validate_exp: false` on the `jsonwebtoken` `Validation`.
- An OAuth `client_secret` is hardcoded as a string literal and passed to the `oauth2` crate's `ClientSecret::new(...)`.
- OAuth token request uses the Resource Owner Password Credentials grant (`grant_type=password`).
- A JWTKit HMAC signing key is registered from a hard-coded string literal (`add(hmac: "...", ...)`).
- A secret, API key, token, or password is assigned from a hard-coded string literal.
- A token, secret, or credential is written to `UserDefaults`.
- A credential (client secret, API key, password, bearer token) is hard-coded as a value in `res/values/strings.xml`.
- A JWT is decoded with a read-only API that performs NO validation (`new JwtSecurityToken(tokenString)`, `handler.ReadJwtToken(...)`, or `new JsonWebToken(tokenString)`).
- A JWT setup sets `RequireExpirationTime = false` on `TokenValidationParameters`.
- A password validation schema is enforcing a minimum length of less than 8 characters.
- A secret-shaped value (`password`, `token`, `secret`, `apiKey`, `csrf`, `hmac`) is being compared with `===` / `!==` / `string1 == string2`.
- A JWT parser turns off registered-claims validation with `jwt.WithoutClaimsValidation()`.
- This JWT is verified for signature but its intended-recipient claims are never asserted: the Auth0 `JWT.require(alg)...build()` verifier pins no `withIssuer(...)`/`withAudience(...)`, or the jjwt parser sets a signature key but pins no `requireIssuer(...)`/`requireAudience(...)`.
- An OAuth 2.0 client secret is hard-coded as a string literal in a Spring Security `ClientRegistration` builder (`.clientSecret("...")`).
- `jwt.decode()` from `jsonwebtoken` only parses the token.
- `ignoreExpiration: true` in a `jsonwebtoken` `verify()` call disables the `exp` claim check.
- A JWT is verified with jose `jwtVerify(...)` but no `audience` option is passed, so the `aud` claim is never checked.
- A JWT is verified with jose `jwtVerify(...)` but no `issuer` option is passed, so the `iss` claim is never checked.
- `jwt.verify(...)` is called without an explicit `algorithms` allowlist.
- JWT is being verified without checking the `aud` (audience) claim.
- JWT is signed without any `expiresIn` / `exp` claim, OR a token is verified without an `maxAge` check.
- An AppAuth `AuthorizationRequest.Builder` explicitly disables PKCE with `.setCodeVerifier(null)`.
- A Ktor session cookie is configured without `cookie.secure = true`, so the browser will send it over plain HTTP as well as HTTPS.
- A JWT is decoded but its signature is never verified.
- This JWT verifier checks the signature but never asserts the token's intended recipient: the Auth0 `JWT.require(alg)...build()` chain pins no `.withIssuer(...)` and no `.withAudience(...)`.
- This MCP server enforces bearer auth via `requireBearerAuth(...)` but passes no `resourceMetadataUrl`.
- This MCP `StreamableHTTPServerTransport` derives its session id from a predictable source: `Date.now()`, `Math.random()`, or an incrementing counter (CWE-330).
- An OAuth token-lifetime field is set to a literal value longer than 24 hours.
- OIDC authorization request (scope contains `openid`) is being built WITHOUT a `nonce` parameter.
- PKCE is configured with `code_challenge_method=plain`.
- A `passport-jwt` strategy is configured with `ignoreExpiration: true`.
- A JWT is decoded with a verification key but WITHOUT an explicit `algorithms` allowlist.
- A JWT is decoded with `options={"verify_exp": False}`, which turns off PyJWT's `exp` (expiration) check.
- PyJWT `jwt.decode(...)` verifies the signature (an `algorithms` list is given) but passes no `audience`, so the `aud` claim is not checked.
- PyJWT decode disables audience or issuer checks.
- This MCP server enables auth via `AuthSettings(...)` but never sets `resource_server_url`.
- `JWT.decode` is called with verification enabled (`true`) but no `algorithm:` / `algorithms:` option, so the library trusts whatever `alg` the token header names.
- A secret-shaped value (`password`, `token`, `secret`, `apikey`, `hmac`, `signature`, `mac`, `digest`) is being compared with `==` / `!=`.
- JWT audience (`aud`) validation is disabled by setting `validate_aud: false` on the `jsonwebtoken` `Validation`.
- A JWT is decoded with a `jsonwebtoken` `Validation` that never sets the expected issuer.
- The user is marked as logged in without first regenerating the session id.
- An `ASWebAuthenticationSession` explicitly sets `prefersEphemeralWebBrowserSession = false`.
- An OAuth / OpenID authorization URL is loaded inside a `WKWebView`.
- A Keychain item is created with `kSecAttrAccessibleAlways` (or `kSecAttrAccessibleAlwaysThisDeviceOnly`).
- A token, secret, or credential is bound to `@AppStorage`.
- An auth-looking cookie is being set with a `maxAge` greater than 30 days.
- JWT is being verified without checking the `iss` (issuer) claim.
- A server-side secret read from `process.env` flows into an HTTP response body.
- A server-side secret read from the environment flows into an HTTP response body, leaking it to the client.
- A server-side secret read from the environment flows into an HTTP response sent back to the client, leaking it (CWE-200).
- Untrusted request input flows into the URL of an outbound HTTP request.
- Untrusted request data flows into the URL of an outbound HTTP request.
- Untrusted request input flows into the URL of an outbound HTTP request.
- An argument of an MCP tool handler (`server.registerTool` / `server.tool`) flows into an outbound HTTP request without validation, a server-side request forgery (SSRF, CWE-918).
- Untrusted request data flows into an outbound HTTP request without validation, a Server-Side Request Forgery (SSRF, CWE-918).
- An argument of an MCP tool handler (`@mcp.tool()`) flows into an outbound HTTP request without validation, a server-side request forgery (SSRF, CWE-918).
- Untrusted request input flows into the URL of an outbound HTTP request.
- The better-auth `secret` is set to a hard-coded string literal.
- CORS is configured to allow the literal origin `'null'`.
- CORS is configured to echo the request's `Origin` back as `Access-Control-Allow-Origin`.
- CORS is configured with `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Credentials: true` at the same time.
- A cookie is created with `HttpOnly = false`, making it readable from client-side JavaScript.
- A cookie policy is set to `SecurePolicy = CookieSecurePolicy.None`, which lets authentication and session cookies be sent over plain HTTP.
- A CORS policy combines credentialed requests with a wildcard or reflected origin (`AllowCredentials()` together with `AllowAnyOrigin()` or `SetIsOriginAllowed(...)` that returns true for everything).
- An OIDC/JWT bearer handler disables HTTPS for its metadata and token exchange (`RequireHttpsMetadata = false`).
- TLS server-certificate validation is turned off: the handler accepts any certificate via `DangerousAcceptAnyServerCertificateValidator` or a callback that always returns `true`.
- `@fastify/cors` is registered with a wildcard/reflected origin (`origin: '*'` or `origin: true`) together with `credentials: true`.
- HTTP Basic credentials flow into a logging call (`console.*` or `logger.*`).
- An OAuth/OIDC credential from the request flows into a logging call.
- A Gin auth/session cookie is written with `secure` or `httpOnly` set to a literal `false`.
- A session/auth `http.Cookie` is created with a security attribute explicitly disabled (`Secure: false` or `HttpOnly: false`).
- CORS is configured to allow every origin with the wildcard `*`.
- An Echo CORS middleware is configured to allow every origin with the wildcard `"*"`.
- A Fiber CORS middleware is configured with the wildcard origin `"*"`.
- An OAuth/OIDC credential from the HTTP request flows into a logging call.
- Hono's `cors()` middleware is given an `origin` function that reflects the caller's origin straight back (`origin: (origin) => origin`) together with `credentials: true`.
- A servlet Cookie is created with a security attribute explicitly disabled.
- CORS is configured to allow every origin with the wildcard `*`.
- CORS is configured to allow any origin together with credentials.
- A `WebViewClient.onReceivedSslError(...)` handler calls `handler.proceed()`, telling the WebView to ignore a TLS certificate error and load the page anyway.
- A Ktor CORS configuration combines `anyHost()` with `allowCredentials = true`.
- This MCP `StreamableHTTPServerTransport` is created without DNS-rebinding protection (CWE-346).
- NestJS `app.enableCors()` is configured with a wildcard/reflected origin (`origin: '*'` or `origin: true`) together with `credentials: true`.
- The NextAuth/Auth.js `secret` is set to a hard-coded string literal.
- An OAuth `client_secret` (or similarly sensitive credential) is being assigned a hard-coded string literal.
- A session/auth cookie is issued with a security attribute explicitly disabled.
- Flask-CORS allows any origin while credentials are enabled.
- FastAPI CORS allows any origin with credentials.
- An OAuth/OIDC credential from the request flows into a logging call.
- A session/auth cookie is built with a security attribute explicitly disabled (`secure(false)` or `http_only(false)`).
- A wide-open CORS policy is configured.
- A hard-coded credential matching a well-known provider's key format was found in the source.
- The manifest sets `android:usesCleartextTraffic="true"` on `<application>`, re-enabling plaintext HTTP for the entire app.
- A session/auth cookie is being set WITHOUT the `HttpOnly` flag.
- A cookie that looks like a session or auth cookie is being set WITHOUT the `Secure` flag.
- A cookie is being set with `SameSite=None` but WITHOUT `Secure`.
- A cookie is set to `SameSite = SameSiteMode.None`, which removes the SameSite defense and sends the cookie on cross-site requests.
- A secret-shaped value is passed to a logging call.
- A session/auth cookie is set with Hono's `setCookie(c, name, value, ...)` helper WITHOUT the `Secure` flag, or with `secure`/`httpOnly` explicitly disabled.
- A JWT (or other auth token) is being written to `localStorage`.
- An authentication / OAuth endpoint is called over cleartext `http://`.
- An OAuth authorization URL is loaded inside an in-app `WebView` (`webView.loadUrl("...authorize?client_id=...")`).
- An authentication-related cookie is set without the `Secure` and/or `HttpOnly` flags (or with `SameSite=None`).
- A Laravel session config hard-codes an insecure cookie flag: `'secure' => false`, `'http_only' => false`, or `'same_site' => 'none'`.
- This endpoint sends `Access-Control-Allow-Credentials: true` together with an `Access-Control-Allow-Origin` that is either the wildcard `*` or the request's own `Origin` reflected back unchecked.
- A Laravel Socialite OAuth flow calls `->stateless()`, which disables the `state` parameter that ties the redirect to the user's session.
- A PHP session hardening flag is turned off at runtime with `ini_set()`: `session.cookie_httponly`, `session.cookie_secure`, or `session.use_only_cookies` set to `0` / `'0'` / `false`.
- This FastMCP server binds to `0.0.0.0` and serves a network transport (streamable-http / SSE) without DNS-rebinding protection (CWE-346).
- A rack-cors `allow` block combines `origins '*'` with `credentials: true`.
- A Vapor `CORSMiddleware.Configuration` combines `allowedOrigin: .all` (the `*` wildcard) with `allowCredentials: true`.
- An exported activity registers a BROWSABLE intent-filter for a custom-scheme OAuth redirect (`android:scheme="com.example.app"` with an oauth/callback/ redirect host).
- A network-security-config permits cleartext traffic (`cleartextTrafficPermitted="true"`) in a `<base-config>` or in a `<domain-config>` that is not restricted to a loopback dev host.
- A session/auth cookie is being set WITHOUT the `SameSite` attribute.
WEB APPLICATION TOP 10 · 2021
- better-auth's CSRF / origin protection is explicitly disabled.
- An authentication/authorization middleware does nothing but call `next()`.
- Untrusted request input flows into a redirect destination.
- Untrusted request data flows into an HTTP redirect destination.
- This AWS IAM trust policy federates GitHub Actions OIDC (token.actions.githubusercontent.com) with an `aud` condition but sets no `sub` condition at all, so ANY GitHub repository, owned by anyone, can assume this role.
- This AWS IAM trust policy federates GitHub Actions OIDC (token.actions.githubusercontent.com) but pins the `sub` claim to a wildcard pattern, so any repository, branch, or pull request matching the glob can assume this role.
- This Terraform resource registers an OAuth redirect/callback URL that is either plaintext http:// (not on localhost) or uses a wildcard host.
- Spring Security CSRF protection is disabled.
- Spring Security authorizes every request without authentication via `anyRequest().permitAll()`.
- Spring excludes all paths from the security filter chain.
- Spring permits every request via a catch-all matcher.
- A NestJS guard's `canActivate` returns a constant `true`.
- The NextAuth/Auth.js `authorized` callback returns `true` unconditionally.
- The NextAuth/Auth.js `redirect` callback returns the incoming `url` without validating it against `baseUrl`.
- DRF disables authentication globally with an empty `DEFAULT_AUTHENTICATION_CLASSES` list.
- DRF makes every endpoint public because `DEFAULT_PERMISSION_CLASSES` is set to `AllowAny`.
- A DRF view disables authentication with an empty `authentication_classes` list.
- Untrusted request data flows into a Flask `redirect(...)` without validation, an open redirect (CWE-601).
- An OmniAuth provider is configured with `provider_ignores_state: true`, which disables verification of the OAuth `state` parameter on the callback.
- A redirect target comes straight from user input (a query-string value or a `returnUrl`-style parameter) and is passed to `Redirect(...)` without a local-URL check.
- Spring Security grants `permitAll()` to a sensitive management path.
- A Django view disables CSRF protection.
- A Doorkeeper (OAuth provider) initializer weakens a core protection: `force_ssl_in_redirect_uri false` allows plaintext `http://` redirect URIs (authorization codes/tokens travel in cleartext and are open to interception/redirect tampering, CWE-601); `allow_blank_redirect_uri true` accepts clients with no registered redirect URI; and an unconditional `skip_authorization do true end` auto-approves EVERY client with no user consent.
- OmniAuth is configured to accept GET requests on the request phase (`allowed_request_methods` includes `:get`, or `silence_get_warning` is set to `true`).
- A Rails controller disables CSRF protection with `skip_before_action :verify_authenticity_token`.
- A security-sensitive value is generated with `System.Random` or `Guid.NewGuid()` inside a token/secret/OTP generator.
- A password is hashed with a fast general-purpose digest (`MD5`, `SHA1`, `SHA256`, `SHA512`) from System.Security.Cryptography.
- A password is being hashed with a fast, general-purpose hash (MD5/SHA-1/SHA-256/SHA-512 via `crypto.createHash`).
- A broken or deprecated block/stream cipher is used to protect data.
- A password is being hashed with a fast, general-purpose digest from the Go standard library (MD5, SHA-1, SHA-256, SHA-512).
- A security-sensitive value is being generated with the `math/rand` package.
- An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
- A `tls.Config` sets `InsecureSkipVerify: true`, disabling TLS certificate verification.
- A `tls.Config` is created with `MinVersion` pinned to an obsolete protocol: SSL 3.0, TLS 1.0, or TLS 1.1.
- A JCA `Cipher` is being created in ECB mode (or with a bare algorithm alias that defaults to ECB).
- A security-sensitive value (token, secret, key, password, nonce, OTP, or salt) is generated with a non-cryptographic PRNG.
- Spring stores passwords with no hashing.
- A password is being hashed with a fast, general-purpose digest from the JCA `MessageDigest` (MD5, SHA-1, SHA-256, SHA-512).
- An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
- TLS hostname verification is disabled.
- An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
- passlib configured with a weak or plaintext password scheme.
- A security-sensitive value is being generated with the `random` module.
- A `requests` call disables TLS certificate verification with `verify=False`.
- A password is being hashed with a fast, general-purpose digest from `hashlib` (MD5, SHA-1, SHA-256, SHA-512).
- An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
- `OAUTHLIB_INSECURE_TRANSPORT` is set, disabling oauthlib's HTTPS requirement for OAuth flows.
- An OAuth client fetches or refreshes a token with TLS certificate verification disabled (`verify=False`).
- A broken or deprecated cipher from the RustCrypto ecosystem is used to protect data.
- A password is hashed with a fast, general-purpose digest unsuitable for password storage.
- An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
- A reqwest client is built with `danger_accept_invalid_certs(true)`, which turns off TLS certificate validation.
- A reqwest client is built with `danger_accept_invalid_hostnames(true)`, which turns off TLS hostname verification.
- A secret is being read from an environment variable whose name carries a client-public prefix.
- TLS certificate validation is disabled for this connection.
- A symmetric cipher is configured with `CipherMode.ECB`.
- A bcrypt cost factor below 10 was used.
- `bcrypt.GenerateFromPassword` is called with a cost factor below 10.
- A broken hash algorithm (MD5 or SHA-1) is being instantiated via JCA `MessageDigest.getInstance(...)`.
- The NextAuth/Auth.js `session` callback copies an OAuth token onto the `session` object.
- A symmetric cipher is configured in ECB mode.
- `bcrypt::hash` (or `bcrypt::hash_with_result`) is called with a cost factor below 10.
- A fully-permissive wildcard appears in better-auth's `trustedOrigins`.
- A static file handler is configured with `dotfiles: 'allow'`, which serves dotfiles from the mounted directory.
- A Flask cookie security flag is disabled through `app.config`, weakening session and remember-me cookie protection.
- better-auth is configured to issue insecure session cookies.
- An Express session cookie is explicitly configured as insecure.
- A Helmet security header is explicitly turned off.
- Express is configured to trust EVERY proxy (`app.set('trust proxy', true)` or the equivalent `app.enable('trust proxy')`).
- Fastify is created with `trustProxy: true`, which trusts EVERY proxy.
- Spring Security's `X-Frame-Options` header is disabled.
- A NextAuth/Auth.js custom cookie is configured as insecure.
- The NextAuth/Auth.js config hard-codes `debug: true`.
- An OAuth `access_token` (or `refresh_token` / `id_token`) is placed in a URL query string.
- An OAuth/OIDC token is written to `localStorage` / `sessionStorage`, readable by any script on the origin.
- django-cors-headers is configured to allow every origin, disabling cross-origin access control.
- Starlette's `TrustedHostMiddleware` is added but configured to trust every Host header (`allowed_hosts=["*"]`, or a list that contains `"*"`).
- Debug mode is hard-coded to `True`.
- The Rails cookie session store is configured with `secure: false` or `httponly: false`.
- `cookie-parser` is initialised with a hard-coded string secret (`cookieParser('some-secret')`).
- `@fastify/cookie`, `@fastify/session`, or `@fastify/secure-session` is registered with a hard-coded `secret` string literal.
- This Terraform resource provisions an OAuth client with the implicit grant enabled (grant_types or allowed_oauth_flows contains "implicit").
- A FastAPI security dependency (`Security(...)`, an API-key scheme such as `APIKeyHeader`/`APIKeyQuery`/`APIKeyCookie`, or an OAuth2 bearer scheme) injects a credential that is then compared against a hard-coded string literal.
- A FastAPI HTTP Basic auth dependency compares the request's username or password against a hard-coded string literal.
- Starlette's `SessionMiddleware` is configured with a hard-coded `secret_key` string literal.
- The Django `SECRET_KEY` is set to a hard-coded string literal in settings.
- The Flask `SECRET_KEY` (used to sign session cookies and CSRF tokens) is set to a hard-coded string literal.
- A Rails `secret_key_base` / `secret_key` is assigned a hard-coded string literal.
- An `express-session` / `cookie-session` `secret` is a hard-coded string literal.
- A secret-like key (client_secret, token, password, api_key, ...) is assigned a hard-coded literal in this CI workflow instead of being read from the secret store.
- A secret-like attribute (client_secret, token, password, api_key, private_key, ...) is assigned a hard-coded string literal in Terraform.
← all rules Coverage is derived from the shipped rule pack, so it grows with the rules.