v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.java.oauth.insecure-token-endpoint

An OAuth/OIDC endpoint is being contacted over cleartext http://.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Authorization codes, client_secret, access/refresh tokens, and the code_verifier then travel unencrypted: a network attacker can read or rewrite them and take over the flow (CWE-319).

RFC 6749 §3.1 / §10.9 require TLS for the authorization and token endpoints. Use https:// for every authorize, token, and userinfo URL. http://localhost and loopback addresses are fine for local development and are not flagged.

VULNERABLE
vulnerable.java
class OAuthEndpoints {

    // Token endpoint over cleartext http://.
    String tokenUrl() {
        // ruleid: auth.java.oauth.insecure-token-endpoint
        return "http://idp.example.com/oauth/token";
    }

    // Authorize request carrying response_type over http://.
    String authorizeUrl(String clientId, String state) {
        // ruleid: auth.java.oauth.insecure-token-endpoint
        return "http://idp.example.com/authorize?response_type=code&client_id=" + clientId
            + "&state=" + state;
    }

    // OIDC connect/token endpoint over http://.
    String introspect() {
        // ruleid: auth.java.oauth.insecure-token-endpoint
        return "http://login.example.com/connect/token";
    }
}
SAFE
safe.java
class OAuthEndpoints {

    // TLS-protected token endpoint.
    String tokenUrl() {
        // ok: auth.java.oauth.insecure-token-endpoint
        return "https://idp.example.com/oauth/token";
    }

    // TLS-protected authorize request.
    String authorizeUrl(String clientId) {
        // ok: auth.java.oauth.insecure-token-endpoint
        return "https://idp.example.com/authorize?response_type=code&client_id=" + clientId;
    }

    // True-negative trap: a cleartext http:// URL that is NOT an OAuth endpoint
    // (no OAuth marker), and a loopback dev token endpoint — neither is flagged.
    String healthUrl() {
        // ok: auth.java.oauth.insecure-token-endpoint
        return "http://status.example.com/health";
    }

    String localDevToken() {
        // ok: auth.java.oauth.insecure-token-endpoint
        return "http://localhost:8080/oauth/token";
    }

    String loopbackToken() {
        // ok: auth.java.oauth.insecure-token-endpoint
        return "http://127.0.0.1:9000/connect/token";
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.java.oauth.insecure-token-endpoint -- <reason>

References

https://datatracker.ietf.org/doc/html/rfc6749#section-3.1 ↗https://datatracker.ietf.org/doc/html/rfc6749#section-10.9 ↗https://cwe.mitre.org/data/definitions/319.html ↗