An ASWebAuthenticationSession explicitly sets prefersEphemeralWebBrowserSession = false.

Why this matters

With a non-ephemeral session the OAuth login reuses the shared Safari cookie jar, so a previously signed-in account is silently re-selected and the user cannot easily switch or fully sign out, a session-confusion / lingering-credential risk (CWE-522). AI-generated auth flows toggle this off to "remember" the user without considering the shared-cookie consequences.

Set prefersEphemeralWebBrowserSession = true so each authorization runs in a private, cookie-isolated session and no credentials persist across logins.

import AuthenticationServices

func startLogin(url: URL, scheme: String, presenter: ASWebAuthenticationPresentationContextProviding) {
    let session = ASWebAuthenticationSession(url: url, callbackURLScheme: scheme) { _, _ in }
    session.presentationContextProvider = presenter

    // ruleid: auth.swift.flow.non-ephemeral-webauth
    session.prefersEphemeralWebBrowserSession = false

    session.start()
}

import AuthenticationServices

func startLogin(url: URL, scheme: String, presenter: ASWebAuthenticationPresentationContextProviding) {
    let session = ASWebAuthenticationSession(url: url, callbackURLScheme: scheme) { _, _ in }
    session.presentationContextProvider = presenter

    // Private, cookie-isolated session per authorization.
    session.prefersEphemeralWebBrowserSession = true

    session.start()
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.swift.flow.non-ephemeral-webauth -- <reason>

References