v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.session.hardcoded-secret

An express-session / cookie-session secret is a hard-coded string literal.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

The infamous secret: 'keyboard cat' is the canonical AI-generated example. This key signs the session cookie: anyone who reads it from your source or git history can forge arbitrary session cookies and impersonate any user.

Load the secret from the environment (process.env.SESSION_SECRET) or a secret manager, and rotate it out of source control. Add a placeholder to .env.example so contributors know it is required.

VULNERABLE
vulnerable.ts
import session from 'express-session';
import cookieSession from 'cookie-session';

// ruleid: auth.session.hardcoded-secret
app.use(session({ secret: 'keyboard cat' }));

// ruleid: auth.session.hardcoded-secret
app.use(session({ secret: 'mysecret', resave: false, saveUninitialized: false }));

// ruleid: auth.session.hardcoded-secret
app.use(cookieSession({ secret: 'abc123', name: 'sess' }));

// ruleid: auth.session.hardcoded-secret
const middleware = session({
  secret: 'super-secret-prod-key',
  cookie: { maxAge: 3600000 },
});
SAFE
safe.ts
import session from 'express-session';
import cookieSession from 'cookie-session';

// ok: auth.session.hardcoded-secret -- loaded from the environment
app.use(session({ secret: process.env.SESSION_SECRET! }));

// ok: auth.session.hardcoded-secret -- pulled from config object
app.use(session({ secret: config.sessionSecret, resave: false }));

// ok: auth.session.hardcoded-secret -- resolved at runtime via secret manager
app.use(cookieSession({ secret: loadSecret(), name: 'sess' }));

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.session.hardcoded-secret -- <reason>

References

https://github.com/expressjs/session#secret ↗https://cwe.mitre.org/data/definitions/798.html ↗