The Rails cookie session store is configured with secure: false or httponly: false.

Why this matters

secure: false lets the session cookie ride over plaintext HTTP where a network attacker can capture it; httponly: false exposes it to document.cookie, so any XSS turns into full session theft (CWE-614). LLM-generated configs flip these off to make sessions work over local HTTP and never restore them.

Drop these overrides. Rails already defaults httponly to true, and gate secure on the environment instead of disabling it, e.g. session_store :cookie_store, secure: Rails.env.production?. Never hard- code secure: false / httponly: false in code that reaches production.

# frozen_string_literal: true

# ruleid: auth.ruby.cookie.insecure-session-store
Rails.application.config.session_store :cookie_store, key: '_app_session', secure: false

# ruleid: auth.ruby.cookie.insecure-session-store
Rails.application.config.session_store :cookie_store, key: '_app_session', httponly: false

# frozen_string_literal: true

# Options omitted -> Rails' secure defaults apply.
Rails.application.config.session_store :cookie_store, key: '_app_session'

# secure is gated on the environment, not disabled.
Rails.application.config.session_store :cookie_store, key: '_app_session', secure: Rails.env.production?

# Explicitly hardened.
Rails.application.config.session_store :cookie_store, key: '_app_session', secure: true, httponly: true

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.ruby.cookie.insecure-session-store -- <reason>

References