v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.csharp.oauth.pkce-disabled

An OpenID Connect handler turns PKCE off (UsePkce = false).

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Without Proof Key for Code Exchange, an authorization code intercepted on the redirect (a malicious app, a leaked URL, a network hop) can be redeemed by the attacker, defeating the code-flow protection that PKCE provides (CWE-287). This is a common AI-generated change made to work around a provider quirk and never reverted.

Leave PKCE enabled: it is the modern default (UsePkce = true) and is required for public clients. Fix the underlying provider configuration rather than disabling the proof key.

VULNERABLE
vulnerable.cs
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.Extensions.DependencyInjection;

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication().AddOpenIdConnect(options =>
        {
            options.Authority = "https://issuer.example.com";
            options.ResponseType = "code";
            // ruleid: auth.csharp.oauth.pkce-disabled
            options.UsePkce = false;
        });
    }
}
SAFE
safe.cs
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.Extensions.DependencyInjection;

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication().AddOpenIdConnect(options =>
        {
            options.Authority = "https://issuer.example.com";
            options.ResponseType = "code";
            options.UsePkce = true;
        });
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.oauth.pkce-disabled -- <reason>

References

https://learn.microsoft.com/aspnet/core/security/authentication/configure-oidc-web-authentication ↗https://cwe.mitre.org/data/definitions/287.html ↗