v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.go.tls.min-version

A tls.Config is created with MinVersion pinned to an obsolete protocol: SSL 3.0, TLS 1.0, or TLS 1.1.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

These versions have known cryptographic weaknesses (POODLE, BEAST, downgrade attacks) and are deprecated by RFC 8996. Allowing them lets an attacker negotiate a broken cipher and intercept or tamper with OAuth/OIDC traffic, leaking authorization codes, access tokens, and client secrets.

Set MinVersion to at least tls.VersionTLS12, and ideally tls.VersionTLS13, so the handshake refuses obsolete protocols.

VULNERABLE
vulnerable.go
package main

import (
	"crypto/tls"
	"net/http"
)

func tls10Client() *http.Client {
	// ruleid: auth.go.tls.min-version
	tr := &http.Transport{TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS10}}
	return &http.Client{Transport: tr}
}

func tls11Config() *tls.Config {
	// ruleid: auth.go.tls.min-version
	return &tls.Config{MinVersion: tls.VersionTLS11}
}

func ssl30Config() tls.Config {
	// ruleid: auth.go.tls.min-version
	return tls.Config{MinVersion: tls.VersionSSL30}
}
SAFE
safe.go
package main

import (
	"crypto/tls"
	"net/http"
)

func tls12Client() *http.Client {
	// ok: auth.go.tls.min-version
	tr := &http.Transport{TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS12}}
	return &http.Client{Transport: tr}
}

func tls13Config() *tls.Config {
	// ok: auth.go.tls.min-version
	return &tls.Config{MinVersion: tls.VersionTLS13}
}

func defaultConfig() *tls.Config {
	// ok: auth.go.tls.min-version
	return &tls.Config{}
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.go.tls.min-version -- <reason>

References

https://pkg.go.dev/crypto/tls#Config ↗https://datatracker.ietf.org/doc/html/rfc8996 ↗https://cwe.mitre.org/data/definitions/326.html ↗