v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.kotlin.cookie.insecure-session

A Ktor session cookie is configured without cookie.secure = true, so the browser will send it over plain HTTP as well as HTTPS.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

On any unencrypted request the session identifier is exposed to network eavesdroppers and can be captured and replayed to hijack the session (CWE-614, Sensitive Cookie Without 'Secure' Attribute). This is a common AI-generated mistake: the cookie<Session>(...) { } block sets path/maxAge but omits the security flags.

Mark the cookie secure (and add signing/encryption) inside the block: cookie.secure = true cookie.httpOnly = true transform(SessionTransportTransformerEncrypt(encryptKey, signKey))

VULNERABLE
vulnerable.kt
import io.ktor.server.application.*
import io.ktor.server.sessions.*

data class UserSession(val userId: String)

fun Application.configureSessions() {
    install(Sessions) {
        // ruleid: auth.kotlin.cookie.insecure-session
        cookie<UserSession>("SESSION") {
            cookie.path = "/"
            cookie.maxAgeInSeconds = 3600
        }
    }
}
SAFE
safe.kt
import io.ktor.server.application.*
import io.ktor.server.sessions.*

data class UserSession(val userId: String)

fun Application.configureSessions(encryptKey: ByteArray, signKey: ByteArray) {
    install(Sessions) {
        cookie<UserSession>("SESSION") {
            cookie.path = "/"
            cookie.maxAgeInSeconds = 3600
            cookie.secure = true
            cookie.httpOnly = true
            transform(SessionTransportTransformerEncrypt(encryptKey, signKey))
        }
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.kotlin.cookie.insecure-session -- <reason>

References

https://ktor.io/docs/server-sessions.html ↗https://cwe.mitre.org/data/definitions/614.html ↗