v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.go.cookie.insecure

A session/auth http.Cookie is created with a security attribute explicitly disabled (Secure: false or HttpOnly: false).

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

With Secure: false the cookie is sent over plain HTTP, so a network attacker can read the session token. With HttpOnly: false the cookie is readable from JavaScript, so any XSS can steal it. For OAuth/OIDC this exposes session and token cookies to theft and hijacking.

Set Secure: true and HttpOnly: true on auth cookies, and add an appropriate SameSite mode (for example SameSite: http.SameSiteLaxMode).

VULNERABLE
vulnerable.go
package main

import "net/http"

func insecureCookie() *http.Cookie {
	// ruleid: auth.go.cookie.insecure
	return &http.Cookie{Name: "session", Value: "abc", Secure: false}
}

func nonHTTPOnlyCookie() *http.Cookie {
	// ruleid: auth.go.cookie.insecure
	return &http.Cookie{Name: "session", Value: "abc", HttpOnly: false}
}

func setInsecureCookie(w http.ResponseWriter) {
	// ruleid: auth.go.cookie.insecure
	c := http.Cookie{Name: "auth", Value: "tok", Secure: false}
	http.SetCookie(w, &c)
}

func setNonHTTPOnlyCookie(w http.ResponseWriter) {
	// ruleid: auth.go.cookie.insecure
	http.SetCookie(w, &http.Cookie{Name: "auth", Value: "tok", HttpOnly: false})
}
SAFE
safe.go
package main

import "net/http"

func secureCookie() *http.Cookie {
	// ok: auth.go.cookie.insecure
	return &http.Cookie{Name: "session", Value: "abc", Secure: true, HttpOnly: true, SameSite: http.SameSiteLaxMode}
}

func defaultCookie() *http.Cookie {
	// ok: auth.go.cookie.insecure
	return &http.Cookie{Name: "session", Value: "abc"}
}

func setSecureCookie(w http.ResponseWriter) {
	// ok: auth.go.cookie.insecure
	http.SetCookie(w, &http.Cookie{Name: "auth", Value: "tok", Secure: true, HttpOnly: true})
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.go.cookie.insecure -- <reason>

References

https://pkg.go.dev/net/http#Cookie ↗https://cwe.mitre.org/data/definitions/614.html ↗