v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.rust.tls.accept-invalid-hostnames

A reqwest client is built with danger_accept_invalid_hostnames(true), which turns off TLS hostname verification.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

The certificate chain is still checked, but a certificate valid for any other domain is accepted for this connection, so an attacker holding a valid certificate for a host they control can intercept the connection and read or tamper with the traffic, a man-in-the-middle hole. For OAuth/OIDC this leaks authorization codes, access tokens, and client secrets in transit.

Never accept invalid hostnames. Leave hostname verification on (the default). To trust a private CA in development, add it explicitly with ClientBuilder::add_root_certificate(cert) instead.

VULNERABLE
vulnerable.rs
use reqwest::Client;

fn build_insecure() -> Client {
    // ruleid: auth.rust.tls.accept-invalid-hostnames
    reqwest::Client::builder()
        .danger_accept_invalid_hostnames(true)
        .build()
        .unwrap()
}

fn build_insecure_inline() -> Client {
    let builder = reqwest::Client::builder().timeout(std::time::Duration::from_secs(30));
    // ruleid: auth.rust.tls.accept-invalid-hostnames
    builder.danger_accept_invalid_hostnames(true).build().unwrap()
}
SAFE
safe.rs
use reqwest::Client;

// ok: auth.rust.tls.accept-invalid-hostnames -- verification left on (default)
fn build_default() -> Client {
    reqwest::Client::builder().build().unwrap()
}

// ok: auth.rust.tls.accept-invalid-hostnames -- explicitly false
fn build_explicit_false() -> Client {
    reqwest::Client::builder()
        .danger_accept_invalid_hostnames(false)
        .build()
        .unwrap()
}

// ok: auth.rust.tls.accept-invalid-hostnames -- private CA added explicitly, not skipping
fn build_with_ca(cert: reqwest::Certificate) -> Client {
    reqwest::Client::builder()
        .add_root_certificate(cert)
        .build()
        .unwrap()
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.rust.tls.accept-invalid-hostnames -- <reason>

References

https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames ↗https://cwe.mitre.org/data/definitions/297.html ↗