OAuthLint rule catalogue
90 rules grouped by category.
COOKIE
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.cookie.long-lived | INFO | MEDIUM | CWE-613 | API2:2023 |
auth.cookie.no-httponly | WARNING | HIGH | CWE-1004 | API8:2023 |
auth.cookie.no-samesite | INFO | MEDIUM | CWE-1275 | API1:2023 |
auth.cookie.no-secure | WARNING | HIGH | CWE-614 | API8:2023 |
CORS
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.cors.null-origin | ERROR | MEDIUM | CWE-942 | A05:2021 |
auth.cors.reflect-origin | ERROR | MEDIUM | CWE-942 | A05:2021 |
auth.cors.wildcard-with-credentials | ERROR | HIGH | CWE-942 | API8:2023 |
FLOW
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.flow.credentials-in-url | ERROR | HIGH | CWE-598 | API2:2023 |
auth.flow.insecure-random | ERROR | HIGH | CWE-338 | API2:2023 |
auth.flow.no-rate-limit | INFO | HIGH | CWE-307 | API4:2023 |
auth.flow.password-min-length | WARNING | MEDIUM | CWE-521 | API2:2023 |
auth.flow.password-plaintext | ERROR | MEDIUM | CWE-256 | API2:2023 |
auth.flow.secret-in-log | WARNING | HIGH | CWE-532 | API8:2023 |
auth.flow.timing-unsafe-compare | WARNING | MEDIUM | CWE-208 | API2:2023 |
auth.flow.weak-bcrypt-rounds | WARNING | MEDIUM | CWE-916 | A02:2021 |
auth.flow.weak-password-hash | ERROR | HIGH | CWE-916 | A02:2021 |
GO-COOKIE
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.go.cookie.insecure | ERROR | HIGH | CWE-614 | A05:2021 |
GO-CORS
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.go.cors.allow-all | ERROR | HIGH | CWE-942 | A05:2021 |
GO-CRYPTO
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.go.crypto.bcrypt-low-cost | WARNING | MEDIUM | CWE-916 | A02:2021 |
auth.go.crypto.weak-cipher | ERROR | MEDIUM | CWE-327 | A02:2021 |
auth.go.crypto.weak-password-hash | ERROR | HIGH | CWE-916 | A02:2021 |
GO-FLOW
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.go.flow.weak-rand | ERROR | HIGH | CWE-330 | A02:2021 |
GO-JWT
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.go.jwt.hardcoded-secret | ERROR | HIGH | CWE-798 | API2:2023 |
auth.go.jwt.none-algorithm | ERROR | HIGH | CWE-347 | API2:2023 |
auth.go.jwt.parse-unverified | ERROR | HIGH | CWE-347 | API2:2023 |
auth.go.jwt.unchecked-method | ERROR | HIGH | CWE-347 | API2:2023 |
GO-TLS
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.go.tls.insecure-skip-verify | ERROR | HIGH | CWE-295 | A02:2021 |
auth.go.tls.min-version | ERROR | MEDIUM | CWE-326 | A02:2021 |
JAVA-COOKIE
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.java.cookie.insecure | ERROR | HIGH | CWE-614 | A05:2021 |
JAVA-CORS
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.java.cors.allow-all | ERROR | HIGH | CWE-942 | A05:2021 |
JAVA-CRYPTO
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.java.crypto.ecb-mode | ERROR | MEDIUM | CWE-327 | A02:2021 |
auth.java.crypto.insecure-random | ERROR | HIGH | CWE-330 | A02:2021 |
auth.java.crypto.weak-password-hash | ERROR | HIGH | CWE-916 | A02:2021 |
JAVA-JWT
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.java.jwt.hardcoded-secret | ERROR | HIGH | CWE-798 | API2:2023 |
auth.java.jwt.unsigned-jwt | ERROR | MEDIUM | CWE-347 | API2:2023 |
JAVA-SESSION
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.java.session.fixation-disabled | ERROR | MEDIUM | CWE-384 | A07:2021 |
JAVA-TLS
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.java.tls.trust-all-certs | ERROR | HIGH | CWE-295 | A02:2021 |
JAVA-WEB
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.java.web.csrf-disabled | ERROR | HIGH | CWE-352 | A01:2021 |
auth.java.web.frame-options-disabled | WARNING | MEDIUM | CWE-1021 | A05:2021 |
auth.java.web.permit-all | ERROR | HIGH | CWE-862 | A01:2021 |
JWT
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.jwt.alg-none | ERROR | HIGH | CWE-327 | API2:2023 |
auth.jwt.algorithm-confusion | ERROR | MEDIUM | CWE-327 | API2:2023 |
auth.jwt.decode-without-verify | WARNING | HIGH | CWE-347 | API2:2023 |
auth.jwt.in-url | ERROR | MEDIUM | CWE-598 | API1:2023 |
auth.jwt.localstorage | WARNING | HIGH | CWE-922 | API8:2023 |
auth.jwt.no-algorithms-allowlist | WARNING | HIGH | CWE-347 | API2:2023 |
auth.jwt.no-audience | WARNING | MEDIUM | CWE-345 | API2:2023 |
auth.jwt.no-expiration | WARNING | HIGH | CWE-613 | API2:2023 |
auth.jwt.no-issuer | INFO | LOW | CWE-345 | API2:2023 |
auth.jwt.weak-secret | ERROR | HIGH | CWE-798 | API2:2023 |
OAUTH
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.oauth.broad-scope | INFO | HIGH | CWE-272 | API1:2023 |
auth.oauth.hardcoded-secret | ERROR | HIGH | CWE-798 | API8:2023 |
auth.oauth.implicit-flow | ERROR | MEDIUM | CWE-1004 | API1:2023 |
auth.oauth.long-token-lifetime | WARNING | MEDIUM | CWE-613 | API2:2023 |
auth.oauth.no-nonce | WARNING | MEDIUM | CWE-294 | API2:2023 |
auth.oauth.no-pkce | WARNING | HIGH | CWE-345 | API1:2023 |
auth.oauth.no-state | ERROR | HIGH | CWE-352 | API1:2023 |
auth.oauth.no-state-validation | WARNING | HIGH | CWE-352 | API1:2023 |
auth.oauth.open-redirect-callback | ERROR | HIGH | CWE-601 | API1:2023 |
auth.oauth.pkce-plain | WARNING | MEDIUM | CWE-757 | API2:2023 |
auth.oauth.wildcard-redirect | ERROR | MEDIUM | CWE-601 | API1:2023 |
PY-COOKIE
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.py.cookie.insecure-flags | ERROR | HIGH | CWE-614 | A05:2021 |
PY-FLOW
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.py.flow.csrf-exempt | WARNING | HIGH | CWE-352 | A01:2021 |
auth.py.flow.debug-enabled | WARNING | HIGH | CWE-489 | A05:2021 |
auth.py.flow.insecure-random-token | ERROR | HIGH | CWE-330 | A02:2021 |
auth.py.flow.requests-verify-disabled | ERROR | HIGH | CWE-295 | API8:2023 |
auth.py.flow.weak-password-hash | ERROR | HIGH | CWE-916 | A02:2021 |
PY-JWT
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.py.jwt.alg-none | ERROR | HIGH | CWE-347 | API2:2023 |
auth.py.jwt.hardcoded-secret | ERROR | HIGH | CWE-798 | API2:2023 |
auth.py.jwt.no-algorithms | WARNING | HIGH | CWE-347 | API2:2023 |
auth.py.jwt.no-verify | ERROR | HIGH | CWE-347 | API2:2023 |
PY-SECRET
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.py.secret.django-hardcoded-key | ERROR | HIGH | CWE-798 | A07:2021 |
auth.py.secret.flask-hardcoded-key | ERROR | HIGH | CWE-798 | A07:2021 |
RUST-COOKIE
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.rust.cookie.insecure | ERROR | HIGH | CWE-614 | A05:2021 |
RUST-CORS
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.rust.cors.permissive | ERROR | MEDIUM | CWE-942 | A05:2021 |
RUST-CRYPTO
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.rust.crypto.bcrypt-low-cost | WARNING | MEDIUM | CWE-916 | A02:2021 |
auth.rust.crypto.weak-cipher | ERROR | MEDIUM | CWE-327 | A02:2021 |
auth.rust.crypto.weak-password-hash | ERROR | HIGH | CWE-916 | A02:2021 |
RUST-FLOW
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.rust.flow.timing-unsafe-compare | WARNING | MEDIUM | CWE-208 | API2:2023 |
RUST-JWT
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.rust.jwt.disable-signature-validation | ERROR | MEDIUM | CWE-347 | API2:2023 |
auth.rust.jwt.hardcoded-secret | ERROR | HIGH | CWE-798 | API2:2023 |
auth.rust.jwt.no-aud-validation | WARNING | MEDIUM | CWE-287 | API2:2023 |
auth.rust.jwt.no-expiration-validation | ERROR | MEDIUM | CWE-613 | API2:2023 |
RUST-TLS
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.rust.tls.accept-invalid-certs | ERROR | HIGH | CWE-295 | A02:2021 |
auth.rust.tls.accept-invalid-hostnames | ERROR | HIGH | CWE-297 | A02:2021 |
SECRET
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.secret.provider-key | ERROR | HIGH | CWE-798 | API8:2023 |
auth.secret.public-env-secret | ERROR | HIGH | CWE-200 | A02:2021 |
SESSION
| Rule | Severity | LLM | CWE | OWASP |
|---|---|---|---|---|
auth.session.hardcoded-secret | ERROR | HIGH | CWE-798 | A07:2021 |
auth.session.id-in-url | ERROR | MEDIUM | CWE-598 | API1:2023 |
auth.session.no-regeneration | WARNING | MEDIUM | CWE-384 | API2:2023 |