v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.csharp.oauth.hardcoded-client-secret

An OAuth/OIDC client secret is assigned from a hard-coded string literal (options.ClientSecret = "...").

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

This secret authenticates the whole application to the identity provider: committed to source control it is one search away from letting an attacker impersonate the app, redeem codes, and obtain tokens (CWE-798). This is a common AI-generated mistake: the literal secret is inlined to make the sample "just work" and never externalized.

Read it from configuration or a secret store instead (e.g. options.ClientSecret = builder.Configuration["Authentication:ClientSecret"] or a value from Azure Key Vault / environment) and rotate the leaked secret out of source control.

VULNERABLE
vulnerable.cs
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.Extensions.DependencyInjection;

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication().AddOpenIdConnect(options =>
        {
            options.ClientId = "web-app";
            // ruleid: auth.csharp.oauth.hardcoded-client-secret
            options.ClientSecret = "9f8e7d6c-5b4a-3210-fedc-ba9876543210";
        });
    }
}
SAFE
safe.cs
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;

public class Startup
{
    private readonly IConfiguration _config;

    public Startup(IConfiguration config)
    {
        _config = config;
    }

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication().AddOpenIdConnect(options =>
        {
            options.ClientId = "web-app";
            options.ClientSecret = _config["Authentication:ClientSecret"];
        });
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.oauth.hardcoded-client-secret -- <reason>

References

https://learn.microsoft.com/aspnet/core/security/app-secrets ↗https://cwe.mitre.org/data/definitions/798.html ↗