v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: HIGH auth.cookie.no-httponly

A session/auth cookie is being set WITHOUT the HttpOnly flag.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

Any XSS that lands on a page in the same origin will be able to read this cookie via document.cookie and exfiltrate the session.

Set { httpOnly: true } on every authentication cookie. If a front-end framework genuinely needs to read it from JS, that is a design problem. Server-side state is the right answer.

VULNERABLE
vulnerable.ts
import type { Response } from 'express';

export function loginBad(res: Response, token: string) {
  // ruleid: auth.cookie.no-httponly
  res.cookie('session', token, { secure: true, sameSite: 'lax' });
}

export function loginBad2(res: Response, jwt: string) {
  // ruleid: auth.cookie.no-httponly
  res.cookie('auth_token', jwt, { secure: true });
}

export function loginBad3(res: Response, token: string) {
  // ruleid: auth.cookie.no-httponly -- httpOnly explicitly disabled
  res.cookie('session', token, { secure: true, httpOnly: false });
}

export function loginBad4(res: Response, jwt: string) {
  // ruleid: auth.cookie.no-httponly -- 2-arg form, no options at all
  res.cookie('session_id', jwt);
}
SAFE
safe.ts
import type { Response } from 'express';

// ok: auth.cookie.no-httponly
export function loginGood(res: Response, token: string) {
  res.cookie('session', token, {
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
  });
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.cookie.no-httponly -- <reason>

References

https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.2.6 ↗