v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.go.tls.insecure-skip-verify

A tls.Config sets InsecureSkipVerify: true, disabling TLS certificate verification.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

This turns off verification of the server's certificate chain and host name, so any attacker who can intercept the connection can present any certificate and read or tamper with the traffic: a classic man-in-the-middle hole. For OAuth/OIDC this leaks authorization codes, access tokens, and client secrets in transit.

Never set InsecureSkipVerify: true. Leave verification on (the default). To trust a private CA in development, set RootCAs to a *x509.CertPool loaded with that CA instead.

VULNERABLE
vulnerable.go
package main

import (
	"crypto/tls"
	"net/http"
)

func badClient() *http.Client {
	// ruleid: auth.go.tls.insecure-skip-verify
	tr := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
	return &http.Client{Transport: tr}
}

func badConfig() *tls.Config {
	// ruleid: auth.go.tls.insecure-skip-verify
	return &tls.Config{MinVersion: tls.VersionTLS12, InsecureSkipVerify: true}
}
SAFE
safe.go
package main

import (
	"crypto/tls"
	"crypto/x509"
)

// ok: auth.go.tls.insecure-skip-verify -- verification left on (default)
func goodDefault() *tls.Config {
	return &tls.Config{MinVersion: tls.VersionTLS12}
}

// ok: auth.go.tls.insecure-skip-verify -- explicitly false
func explicitFalse() *tls.Config {
	return &tls.Config{InsecureSkipVerify: false}
}

// ok: auth.go.tls.insecure-skip-verify -- private CA via RootCAs, not skipping
func privateCA(pool *x509.CertPool) *tls.Config {
	return &tls.Config{RootCAs: pool, MinVersion: tls.VersionTLS12}
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.go.tls.insecure-skip-verify -- <reason>

References

https://pkg.go.dev/crypto/tls#Config ↗https://cwe.mitre.org/data/definitions/295.html ↗