MEDIUM AI PREVALENCE: MEDIUM auth.ruby.oauth.doorkeeper-insecure-config

A Doorkeeper (OAuth provider) initializer weakens a core protection: `force_ssl_in_redirect_uri false` allows plaintext `http://` redirect URIs (authorization codes/tokens travel in cleartext and are open to interception/redirect tampering, CWE-601); `allow_blank_redirect_uri true` accepts clients with no registered redirect URI; and an unconditional `skip_authorization do true end` auto-approves EVERY client with no user consent.

CWE-601 OWASP A01:2021 Ruby

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

These are frequent LLM shortcuts to get a local OAuth flow working.

Keep force_ssl_in_redirect_uri on (default) so redirect URIs must be HTTPS, require every client to register a redirect URI, and make skip_authorization conditional on a trusted first-party client rather than returning a bare true, e.g. skip_authorization { |resource_owner, client| client.application.trusted? }.

VULNERABLE

vulnerable.rb

# frozen_string_literal: true

Doorkeeper.configure do
  orm :active_record

  # ruleid: auth.ruby.oauth.doorkeeper-insecure-config
  force_ssl_in_redirect_uri false

  # ruleid: auth.ruby.oauth.doorkeeper-insecure-config
  allow_blank_redirect_uri true

  # ruleid: auth.ruby.oauth.doorkeeper-insecure-config
  skip_authorization do
    true
  end
end

SAFE

safe.rb

# frozen_string_literal: true

Doorkeeper.configure do
  orm :active_record

  # HTTPS redirect URIs are enforced (the default).
  force_ssl_in_redirect_uri true

  # Authorization is skipped only for trusted first-party clients.
  skip_authorization do |resource_owner, client|
    client.application.superapp? || resource_owner.admin?
  end
end

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.ruby.oauth.doorkeeper-insecure-config -- <reason>

References

https://doorkeeper.gitbook.io/guides/ruby-on-rails/skip-authorization ↗https://cwe.mitre.org/data/definitions/601.html ↗