v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.express.cookie-parser-secret

cookie-parser is initialised with a hard-coded string secret (cookieParser('some-secret')).

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

That secret signs every signed cookie (res.cookie(name, val, { signed: true }), read back from req.signedCookies). Anyone who reads it from your source or git history can forge signed cookies and tamper with values your app trusts.

Load the secret from the environment (cookieParser(process.env.COOKIE_SECRET)) or a secret manager, and rotate the leaked value out of source control. Add a placeholder to .env.example so contributors know it is required.

VULNERABLE
vulnerable.ts
import express from 'express';
import cookieParser from 'cookie-parser';

const app = express();

// ruleid: auth.express.cookie-parser-secret
app.use(cookieParser('my-super-secret-key'));

// ruleid: auth.express.cookie-parser-secret
app.use(cookieParser('keyboard cat', { decode: decodeURIComponent }));
SAFE
safe.ts
import express from 'express';
import cookieParser from 'cookie-parser';

const app = express();

// ok: auth.express.cookie-parser-secret -- secret loaded from the environment
app.use(cookieParser(process.env.COOKIE_SECRET));

// ok: auth.express.cookie-parser-secret -- secret from config, not a literal
app.use(cookieParser(config.cookieSecret, { decode: decodeURIComponent }));

// ok: auth.express.cookie-parser-secret -- no secret, unsigned cookies only
app.use(cookieParser());

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.express.cookie-parser-secret -- <reason>

References

https://github.com/expressjs/cookie-parser#cookieparsersecret-options ↗https://cwe.mitre.org/data/definitions/798.html ↗