HIGH AI PREVALENCE: HIGH auth.go.session.hardcoded-secret

A gorilla/sessions or securecookie store is initialized with a hardcoded string-literal key.

CWE-798 OWASP API2:2023 go

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

This key authenticates (and, for securecookie, encrypts) every session cookie: anyone who reads the source or git history can forge a valid session for any user, a complete authentication bypass (CWE-798). This is a common AI-generated shortcut: a literal key is inlined so the sample "just works" and is never externalized.

Load the key(s) from configuration or a secret manager and generate them with a CSPRNG, e.g. store := sessions.NewCookieStore([]byte(os.Getenv("SESSION_KEY"))) Rotate any key that has already been committed to source control.

VULNERABLE

vulnerable.go

package main

import (
	"github.com/gorilla/securecookie"
	"github.com/gorilla/sessions"
)

// ruleid: auth.go.session.hardcoded-secret
var cookieStore = sessions.NewCookieStore([]byte("super-secret-signing-key-123"))

// ruleid: auth.go.session.hardcoded-secret
var fsStore = sessions.NewFilesystemStore("/tmp/sessions", []byte("another-hardcoded-key-456"))

// ruleid: auth.go.session.hardcoded-secret
var sc = securecookie.New([]byte("hash-key-hardcoded-literal"), []byte("block-key-hardcoded"))

SAFE

safe.go

package main

import (
	"os"

	"github.com/gorilla/securecookie"
	"github.com/gorilla/sessions"
)

// Keys loaded from the environment / a secret manager are not flagged.
var cookieStore = sessions.NewCookieStore([]byte(os.Getenv("SESSION_KEY")))

var hashKey = []byte(os.Getenv("SC_HASH_KEY"))
var blockKey = []byte(os.Getenv("SC_BLOCK_KEY"))
var sc = securecookie.New(hashKey, blockKey)

// Obvious placeholder is dropped by the allow-list.
var demo = sessions.NewCookieStore([]byte("changeme"))

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.go.session.hardcoded-secret -- <reason>

References

https://github.com/gorilla/sessions ↗https://github.com/gorilla/securecookie ↗https://cwe.mitre.org/data/definitions/798.html ↗