v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.fastify.cookie-session-secret

@fastify/cookie, @fastify/session, or @fastify/secure-session is registered with a hard-coded secret string literal.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

This key signs the session/cookie: anyone who reads it from your source or git history can forge signed cookies and impersonate any user.

Load it from the environment (fastify.register(fastifySession, { secret: process.env.SESSION_SECRET })) or a secret manager, and add a placeholder to .env.example. The secret must be at least 32 characters. Rotate the leaked value out of source control.

VULNERABLE
vulnerable.ts
import Fastify from 'fastify';
import fastifyCookie from '@fastify/cookie';
import fastifySession from '@fastify/session';

const fastify = Fastify();

// ruleid: auth.fastify.cookie-session-secret
fastify.register(fastifyCookie, { secret: 'k3yb0ard-cat-cookie-secret' });

// ruleid: auth.fastify.cookie-session-secret
fastify.register(fastifySession, {
  secret: 'a-32-char-hardcoded-session-secret',
  cookie: { secure: true },
});
SAFE
safe.ts
import Fastify from 'fastify';
import fastifyCookie from '@fastify/cookie';
import fastifySession from '@fastify/session';

const fastify = Fastify();

// ok: auth.fastify.cookie-session-secret -- secret read from the environment
fastify.register(fastifyCookie, { secret: process.env.COOKIE_SECRET });

// ok: auth.fastify.cookie-session-secret -- secret resolved from config
fastify.register(fastifySession, {
  secret: config.sessionSecret,
  cookie: { secure: true },
});

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.fastify.cookie-session-secret -- <reason>

References

https://github.com/fastify/session#options ↗https://cwe.mitre.org/data/definitions/798.html ↗