HIGH AI PREVALENCE: MEDIUM auth.oauth.implicit-flow

OAuth implicit flow is deprecated by the OAuth 2.0 Security BCP (RFC 9700) and the OAuth 2.1 draft.

CWE-1004 OWASP API1:2023 js · ts

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

It is triggered by response_type=token or response_type=id_token token. The access token leaks into the URL fragment, browser history, and referrer headers, and there is no refresh-token mechanism.

Migrate to authorization code + PKCE (response_type=code with a code_challenge). All modern OAuth providers (Google, Microsoft, Auth0, Okta, Keycloak, WSO2) support this for SPAs and native apps.

VULNERABLE

vulnerable.ts

export const badConfig = {
  // ruleid: auth.oauth.implicit-flow
  response_type: 'token',
  client_id: 'spa-app',
};

// ruleid: auth.oauth.implicit-flow
export const badUrl =
  'https://accounts.google.com/o/oauth2/v2/auth?response_type=token&client_id=spa-app';

export const badConfig2 = {
  // ruleid: auth.oauth.implicit-flow
  response_type: 'id_token token',
};

// ruleid: auth.oauth.implicit-flow -- URL-encoded multi-value response_type
export const badUrlEncoded =
  'https://accounts.google.com/o/oauth2/v2/auth?response_type=token%20id_token&client_id=spa';

SAFE

safe.ts

// ok: auth.oauth.implicit-flow
export const goodConfig = {
  response_type: 'code',
  client_id: 'spa-app',
};

// ok: auth.oauth.implicit-flow
export const goodUrl =
  'https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=spa-app&code_challenge=abc';

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.oauth.implicit-flow -- <reason>

References

https://datatracker.ietf.org/doc/html/rfc9700 ↗