v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.rust.cookie.insecure

A session/auth cookie is built with a security attribute explicitly disabled (secure(false) or http_only(false)).

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

With secure(false) the cookie is sent over plain HTTP, so a network attacker can read the session token. With http_only(false) the cookie is readable from JavaScript, so any XSS can steal it. For OAuth/OIDC this exposes session and token cookies to theft and hijacking.

Set secure(true) and http_only(true) on auth cookies, and add an appropriate SameSite mode (for example same_site(SameSite::Lax)).

VULNERABLE
vulnerable.rs
use cookie::{Cookie, SameSite};

fn session_cookie_insecure() -> Cookie<'static> {
    // ruleid: auth.rust.cookie.insecure
    Cookie::build(("session", "abc123"))
        .secure(false)
        .http_only(true)
        .same_site(SameSite::Lax)
        .build()
}

fn auth_cookie_no_httponly() -> Cookie<'static> {
    // ruleid: auth.rust.cookie.insecure
    Cookie::build(("auth_token", "xyz789"))
        .secure(true)
        .http_only(false)
        .same_site(SameSite::Strict)
        .build()
}

fn id_cookie_inline() -> Cookie<'static> {
    let builder = Cookie::build(("id_token", "tok"));
    // ruleid: auth.rust.cookie.insecure
    builder.secure(false).build()
}
SAFE
safe.rs
use cookie::{Cookie, SameSite};

fn session_cookie_secure() -> Cookie<'static> {
    // ok: auth.rust.cookie.insecure
    Cookie::build(("session", "abc123"))
        .secure(true)
        .http_only(true)
        .same_site(SameSite::Lax)
        .build()
}

fn auth_cookie_defaults() -> Cookie<'static> {
    // ok: auth.rust.cookie.insecure
    Cookie::build(("auth_token", "xyz789"))
        .same_site(SameSite::Strict)
        .build()
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.rust.cookie.insecure -- <reason>

References

https://docs.rs/cookie/latest/cookie/struct.CookieBuilder.html ↗https://cwe.mitre.org/data/definitions/614.html ↗