v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.csharp.cookie.secure-policy-none

A cookie policy is set to SecurePolicy = CookieSecurePolicy.None, which lets authentication and session cookies be sent over plain HTTP.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

On any non-HTTPS hop an on-path attacker can read the cookie and hijack the session (CWE-614). This is a common AI-generated shortcut to get cookies working over http://localhost that then ships to production.

Use CookieSecurePolicy.Always so the Secure attribute is set and the cookie is only transmitted over HTTPS. Prefer Always over SameAsRequest for auth cookies.

VULNERABLE
vulnerable.cs
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication().AddCookie(options =>
        {
            options.Cookie.Name = ".Auth";
            // ruleid: auth.csharp.cookie.secure-policy-none
            options.Cookie.SecurePolicy = CookieSecurePolicy.None;
        });
    }
}
SAFE
safe.cs
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication().AddCookie(options =>
        {
            options.Cookie.Name = ".Auth";
            options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
        });
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.cookie.secure-policy-none -- <reason>

References

https://learn.microsoft.com/aspnet/core/security/authentication/cookie ↗https://cwe.mitre.org/data/definitions/614.html ↗