v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.hono.cookie-insecure

A session/auth cookie is set with Hono's setCookie(c, name, value, ...) helper WITHOUT the Secure flag, or with secure/httpOnly explicitly disabled.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Missing Secure lets the browser send the cookie over plain HTTP where a network attacker can capture it (CWE-614); httpOnly: false exposes it to document.cookie, so any XSS on the origin can steal the session (CWE-1004).

Harden every auth cookie: setCookie(c, 'session', value, { httpOnly: true, secure: true, sameSite: 'Lax' }) If you genuinely need insecure cookies in dev, gate the value on the environment rather than hard-coding secure: false.

VULNERABLE
vulnerable.ts
import { Hono } from 'hono';
import { setCookie } from 'hono/cookie';

const app = new Hono();

app.post('/login', (c) => {
  const token = issueToken();

  // ruleid: auth.hono.cookie-insecure
  setCookie(c, 'session', token, { httpOnly: false, secure: true });

  // ruleid: auth.hono.cookie-insecure
  setCookie(c, 'auth_token', token, { httpOnly: true, secure: false });

  // ruleid: auth.hono.cookie-insecure
  setCookie(c, 'sid', token, { httpOnly: true, sameSite: 'Lax' });

  // ruleid: auth.hono.cookie-insecure
  setCookie(c, 'refresh_token', token);

  return c.json({ ok: true });
});
SAFE
safe.ts
import { Hono } from 'hono';
import { setCookie } from 'hono/cookie';

const app = new Hono();

app.post('/login', (c) => {
  const token = issueToken();

  // Fully hardened auth cookie.
  setCookie(c, 'session', token, {
    httpOnly: true,
    secure: true,
    sameSite: 'Lax',
    maxAge: 60 * 60 * 24 * 7,
  });

  // `secure` computed from config (not a hard-coded false) — left alone.
  setCookie(c, 'auth_token', token, { httpOnly: true, secure: isProd });

  // Non-auth cookie (name does not look like a session/auth cookie) — ignored.
  setCookie(c, 'theme', 'dark', { httpOnly: false });

  return c.json({ ok: true });
});

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.hono.cookie-insecure -- <reason>

References

https://hono.dev/docs/helpers/cookie ↗https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.2.5 ↗https://cwe.mitre.org/data/definitions/1004.html ↗