v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.py.oauth.insecure-transport-env

OAUTHLIB_INSECURE_TRANSPORT is set, disabling oauthlib's HTTPS requirement for OAuth flows.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

This affects requests-oauthlib, Authlib's requests integration, and Django OAuth Toolkit. oauthlib raises InsecureTransportError to stop you exchanging codes and tokens over cleartext; setting this variable silences that guard, so authorization codes, client_secret, and access/refresh tokens travel over plain http:// where a network attacker can read or rewrite them (CWE-319).

Remove this assignment and serve every OAuth endpoint over https://. For local development use a loopback HTTPS listener or a tunnel rather than disabling transport security in code that can ship to production.

VULNERABLE
vulnerable.py
"""Disabling oauthlib's HTTPS requirement via OAUTHLIB_INSECURE_TRANSPORT."""

import os
from os import environ

from requests_oauthlib import OAuth2Session

# ruleid: auth.py.oauth.insecure-transport-env
os.environ["OAUTHLIB_INSECURE_TRANSPORT"] = "1"

# ruleid: auth.py.oauth.insecure-transport-env
os.environ.setdefault("OAUTHLIB_INSECURE_TRANSPORT", "1")

# ruleid: auth.py.oauth.insecure-transport-env
environ["OAUTHLIB_INSECURE_TRANSPORT"] = "true"


def make_session(client_id: str):
    return OAuth2Session(client_id, redirect_uri="http://localhost/callback")
SAFE
safe.py
"""Keeping oauthlib's transport security on."""

import os

from requests_oauthlib import OAuth2Session


# ok: auth.py.oauth.insecure-transport-env -- reading the flag, not setting it
def is_insecure_allowed() -> bool:
    return os.environ.get("OAUTHLIB_INSECURE_TRANSPORT") == "1"


# ok: auth.py.oauth.insecure-transport-env -- an unrelated environment variable
os.environ["OAUTH_CLIENT_ID"] = "my-client"


def make_session(client_id: str):
    # ok: auth.py.oauth.insecure-transport-env -- https endpoints, no transport bypass
    return OAuth2Session(client_id, redirect_uri="https://app.example.com/callback")

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.oauth.insecure-transport-env -- <reason>

References

https://requests-oauthlib.readthedocs.io/en/latest/oauth2_workflow.html ↗https://datatracker.ietf.org/doc/html/rfc6749#section-3.1 ↗https://cwe.mitre.org/data/definitions/319.html ↗