v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.py.flask.session-cookie-insecure

A Flask cookie security flag is disabled through app.config, weakening session and remember-me cookie protection.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

SESSION_COOKIE_SECURE = False lets the session cookie travel over plain HTTP where it can be sniffed on the wire, and SESSION_COOKIE_HTTPONLY = False exposes it to JavaScript so an XSS payload can read and exfiltrate it; the REMEMBER_COOKIE_* flags do the same for Flask-Login's long-lived remember-me token (CWE-614, OWASP A05:2021). Keep these True (or drive them from an environment check), e.g. app.config["SESSION_COOKIE_SECURE"] = True and app.config["SESSION_COOKIE_HTTPONLY"] = True.

VULNERABLE
vulnerable.py
from flask import Flask

app = Flask(__name__)


# Subscript form on app.config — missed by the bare-assignment rule.
# ruleid: auth.py.flask.session-cookie-insecure
app.config['SESSION_COOKIE_SECURE'] = False

# ruleid: auth.py.flask.session-cookie-insecure
app.config['SESSION_COOKIE_HTTPONLY'] = False

# ruleid: auth.py.flask.session-cookie-insecure
app.config['REMEMBER_COOKIE_SECURE'] = False

# ruleid: auth.py.flask.session-cookie-insecure
app.config['REMEMBER_COOKIE_HTTPONLY'] = False


# Keyword form via config.update(...).
# ruleid: auth.py.flask.session-cookie-insecure
app.config.update(SESSION_COOKIE_SECURE=False, SESSION_COOKIE_SAMESITE="Lax")

# ruleid: auth.py.flask.session-cookie-insecure
app.config.update(REMEMBER_COOKIE_SECURE=False)
SAFE
safe.py
import os

from flask import Flask

app = Flask(__name__)


# ok: auth.py.flask.session-cookie-insecure -- flags hardened via subscript form
app.config['SESSION_COOKIE_SECURE'] = True
app.config['SESSION_COOKIE_HTTPONLY'] = True
app.config['REMEMBER_COOKIE_SECURE'] = True
app.config['REMEMBER_COOKIE_HTTPONLY'] = True


# ok: auth.py.flask.session-cookie-insecure -- driven from the environment
app.config['SESSION_COOKIE_SECURE'] = os.environ.get("PRODUCTION") == "1"


# ok: auth.py.flask.session-cookie-insecure -- update() with secure defaults
app.config.update(SESSION_COOKIE_SECURE=True, REMEMBER_COOKIE_SECURE=True)

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.flask.session-cookie-insecure -- <reason>

References

https://flask.palletsprojects.com/en/stable/config/#SESSION_COOKIE_SECURE ↗https://flask-login.readthedocs.io/en/latest/#cookie-settings ↗https://cwe.mitre.org/data/definitions/614.html ↗