HIGH AI PREVALENCE: MEDIUM auth.session.id-in-url

A session token / id appears in a URL query string.

CWE-598 OWASP API1:2023 js · ts

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

URLs are logged everywhere (web server logs, reverse proxies, browser history, referrer headers leaking to third-party CDNs and ad networks), so this leaks the credential.

Pass session ids/tokens in the Authorization header or in a Secure; HttpOnly cookie. Never in the URL.

OWASP ASVS V3.2 explicitly bans this pattern.

VULNERABLE

vulnerable.ts

// ruleid: auth.session.id-in-url
export const badLink = `/api/profile?session=${'sid-abc-123-very-long-here'}`;

// ruleid: auth.session.id-in-url
export const badLink2 = '/api/admin?api_key=secret-key-here-very-long';

// ruleid: auth.session.id-in-url
export const badLink3 = '/api/data?access_token=eyJabc123';

// ruleid: auth.session.id-in-url -- bare token param
export const badLink4 = '/api/data?token=abc-123-secret';

// ruleid: auth.session.id-in-url -- refresh token param
export const badLink5 = '/auth/refresh?refresh_token=rt-abc-123';

SAFE

safe.ts

// ok: auth.session.id-in-url -- regular query strings, no credentials
export const goodLink = '/api/profile?include=settings';

// ok: auth.session.id-in-url -- Authorization header is the right place
export function fetchWithAuth(url: string, token: string) {
  return fetch(url, {
    headers: { Authorization: `Bearer ${token}` },
  });
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.session.id-in-url -- <reason>

References

https://owasp.org/www-project-application-security-verification-standard/ ↗