v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.csharp.oauth.require-https-metadata-disabled

An OIDC/JWT bearer handler disables HTTPS for its metadata and token exchange (RequireHttpsMetadata = false).

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

The discovery document, JWKS, and token traffic can then travel over plain HTTP, where an on-path attacker can swap signing keys or tokens and defeat the whole trust chain (CWE-319). This is a common AI-generated leftover from local development that ships to production.

Leave RequireHttpsMetadata at its secure default (true). If you truly need cleartext for local development only, guard it behind an environment check such as env.IsDevelopment() so production stays on HTTPS.

VULNERABLE
vulnerable.cs
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.Extensions.DependencyInjection;

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication().AddJwtBearer(options =>
        {
            options.Authority = "https://issuer.example.com";
            // ruleid: auth.csharp.oauth.require-https-metadata-disabled
            options.RequireHttpsMetadata = false;
        });
    }
}
SAFE
safe.cs
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.Extensions.DependencyInjection;

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication().AddJwtBearer(options =>
        {
            options.Authority = "https://issuer.example.com";
            options.RequireHttpsMetadata = true;
        });
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.oauth.require-https-metadata-disabled -- <reason>

References

https://learn.microsoft.com/aspnet/core/security/authentication/configure-oidc-web-authentication ↗https://cwe.mitre.org/data/definitions/319.html ↗