v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.php.cookie.laravel-insecure-session

A Laravel session config hard-codes an insecure cookie flag: 'secure' => false, 'http_only' => false, or 'same_site' => 'none'.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

This turns off protections for the session cookie across the whole app: secure=false lets it travel over plain HTTP, http_only=false exposes it to JavaScript (XSS), and same_site=none sends it on cross-site requests (CWE-614). AI-generated config sets these to false to silence a local-HTTP issue and the insecure default ships.

Drive the flag from the environment (secure by default) instead: 'secure' => env('SESSION_SECURE_COOKIE', true), 'http_only' => true, 'same_site' => 'lax',

VULNERABLE
vulnerable.php
<?php

return [
    'driver' => 'file',
    'lifetime' => 120,

    // ruleid: auth.php.cookie.laravel-insecure-session
    'secure' => false,

    // ruleid: auth.php.cookie.laravel-insecure-session
    'http_only' => false,

    // ruleid: auth.php.cookie.laravel-insecure-session
    'same_site' => 'none',
];
SAFE
safe.php
<?php

return [
    'driver' => 'file',
    'lifetime' => 120,

    // ok: secure by default, overridable per environment
    'secure' => env('SESSION_SECURE_COOKIE', true),

    // ok: env-driven flag whose default happens to be false is a convention,
    // not the effective runtime value, so it must not fire
    'secure_alt' => env('SESSION_SECURE_COOKIE', false),

    // ok: cookie not exposed to JavaScript
    'http_only' => true,

    // ok: same-site protection kept on
    'same_site' => 'lax',
];

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.php.cookie.laravel-insecure-session -- <reason>

References

https://laravel.com/docs/session ↗https://cwe.mitre.org/data/definitions/614.html ↗