v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.php.flow.socialite-stateless

A Laravel Socialite OAuth flow calls ->stateless(), which disables the state parameter that ties the redirect to the user's session.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Without it the callback cannot be bound to the request that started the flow, opening the login to CSRF / authorization-code injection (CWE-352). An attacker can trick a victim into completing the attacker's OAuth flow and link accounts. AI-generated code reaches for stateless() to "fix" a session error and silently removes the CSRF defense.

Keep the stateful (default) flow so Socialite validates state: return Socialite::driver('google')->redirect(); $user = Socialite::driver('google')->user(); Only use stateless() for a token-based API where you validate state yourself.

VULNERABLE
vulnerable.php
<?php

use Laravel\Socialite\Facades\Socialite;

function redirect_to_provider()
{
    // ruleid: auth.php.flow.socialite-stateless
    return Socialite::driver('google')->stateless()->redirect();
}

function callback_with_scopes()
{
    // ruleid: auth.php.flow.socialite-stateless
    return Socialite::driver('github')->scopes(['user:email'])->stateless()->user();
}

function via_instance($socialite)
{
    // ruleid: auth.php.flow.socialite-stateless
    return $socialite->driver('google')->stateless()->user();
}
SAFE
safe.php
<?php

use Laravel\Socialite\Facades\Socialite;

function redirect_to_provider()
{
    // ok: default stateful flow validates the OAuth state parameter
    return Socialite::driver('google')->redirect();
}

function handle_callback()
{
    // ok: stateful user() call
    return Socialite::driver('google')->user();
}

function unrelated($cache)
{
    // ok: a stateless() method on some other object, not a Socialite driver
    return $cache->stateless();
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.php.flow.socialite-stateless -- <reason>

References

https://laravel.com/docs/socialite ↗https://cwe.mitre.org/data/definitions/352.html ↗