MEDIUM AI PREVALENCE: MEDIUM auth.nextauth.cookie-insecure

A NextAuth/Auth.js custom cookie is configured as insecure.

CWE-614 OWASP A05:2021 js · ts

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Setting secure: false lets the browser send the session-token cookie over plain HTTP, and httpOnly: false exposes it to document.cookie so any XSS can read it.

Set secure: true and httpOnly: true on the cookie options (Auth.js already applies these defaults, so the safest fix is to delete the overrides). If you need insecure cookies for local HTTP development, gate the value on process.env.NODE_ENV !== 'production' rather than hard-coding false.

VULNERABLE

vulnerable.ts

import NextAuth from 'next-auth';
import type { NextAuthConfig } from 'next-auth';

export const authConfig: NextAuthConfig = {
  providers: [],
  cookies: {
    sessionToken: {
      name: 'next-auth.session-token',
      options: {
        httpOnly: true,
        sameSite: 'lax',
        path: '/',
        // ruleid: auth.nextauth.cookie-insecure
        secure: false,
      },
    },
  },
};

export const { handlers } = NextAuth({
  providers: [],
  cookies: {
    sessionToken: {
      name: 'next-auth.session-token',
      options: {
        // ruleid: auth.nextauth.cookie-insecure
        httpOnly: false,
        sameSite: 'lax',
        path: '/',
        secure: true,
      },
    },
  },
});

SAFE

safe.ts

import NextAuth from 'next-auth';
import type { NextAuthConfig } from 'next-auth';

export const authConfig: NextAuthConfig = {
  providers: [],
  cookies: {
    sessionToken: {
      name: '__Secure-next-auth.session-token',
      // ok: auth.nextauth.cookie-insecure -- secure and httpOnly are both on
      options: {
        httpOnly: true,
        sameSite: 'lax',
        path: '/',
        secure: true,
      },
    },
  },
};

// ok: auth.nextauth.cookie-insecure -- unrelated cookie config, not a NextAuth options object
const analyticsCookie = {
  name: 'analytics',
  secure: false,
  httpOnly: false,
};

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.nextauth.cookie-insecure -- <reason>

References

https://authjs.dev/reference/core#cookies ↗https://cwe.mitre.org/data/definitions/614.html ↗