HIGH AI PREVALENCE: MEDIUM auth.betterauth.disabled-csrf

better-auth's CSRF / origin protection is explicitly disabled.

CWE-352 OWASP A01:2021 js · ts

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

In advanced, disableCSRFCheck: true turns off ALL of better-auth's CSRF protection (origin-header validation and Fetch-Metadata checks), and disableOriginCheck: true drops the origin-header validation on its own. Either one lets a malicious site drive state-changing authentication requests against a logged-in user's session (CWE-352).

Remove the flag and keep the checks on. If a specific trusted front-end needs to reach the auth API cross-origin, add its exact origin to trustedOrigins instead of disabling the check globally.

VULNERABLE

vulnerable.ts

import { betterAuth } from "better-auth";

// Disabling better-auth's CSRF / origin checks removes the origin-header and
// Fetch-Metadata validation that protects state-changing auth requests.
export const auth = betterAuth({
  advanced: {
    // ruleid: auth.betterauth.disabled-csrf
    disableCSRFCheck: true,
  },
});

export const auth2 = betterAuth({
  advanced: {
    // ruleid: auth.betterauth.disabled-csrf
    disableOriginCheck: true,
  },
});

SAFE

safe.ts

import { betterAuth } from "better-auth";

// ok: CSRF / origin protection left at its secure default (enabled). The app
// simply lists the origins it trusts instead of disabling the check.
export const auth = betterAuth({
  trustedOrigins: ["https://app.example.com"],
  advanced: {
    useSecureCookies: true,
  },
});

export const auth2 = betterAuth({
  advanced: {
    // ok: explicitly keeping the checks on
    disableCSRFCheck: false,
    disableOriginCheck: false,
  },
});

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.betterauth.disabled-csrf -- <reason>

References

https://www.better-auth.com/docs/reference/security ↗https://cwe.mitre.org/data/definitions/352.html ↗