oauthlint-rules 0.1.0

package/rules/cookie/no-samesite.yml

@@ -0,0 +1,56 @@
+rules:
+  - id: auth.cookie.no-samesite
+    languages:
+      - javascript
+      - typescript
+    severity: INFO
+    message: |
+      A session/auth cookie is being set WITHOUT the `SameSite`
+      attribute. Modern browsers default to `Lax`, but explicit is
+      better — and APIs that legitimately need cross-site usage should
+      consciously opt into `None` (with `Secure`), not silently inherit
+      whatever the browser does today.
+
+      For most auth flows, `SameSite=Strict` is the right answer; for
+      OAuth callbacks, `SameSite=Lax` is required.
+    pattern-either:
+      - patterns:
+          - pattern: $RES.cookie($NAME, $VAL, $OPTS)
+          - metavariable-regex:
+              metavariable: $NAME
+              regex: ^(['"])(?:[a-zA-Z0-9_-]*(?:session|sid|sess|auth|token|jwt|refresh|access)[a-zA-Z0-9_-]*)\1$
+          - metavariable-pattern:
+              metavariable: $OPTS
+              patterns:
+                - pattern-not: '{..., sameSite: ..., ...}'
+                - pattern-not: '{..., "sameSite": ..., ...}'
+                - pattern: '{...}'
+      # SameSite=None without Secure: None *requires* Secure, so this cookie is
+      # rejected by modern browsers and signals a real misconfiguration.
+      - patterns:
+          - pattern: $RES.cookie($NAME, $VAL, $OPTS)
+          - metavariable-regex:
+              metavariable: $NAME
+              regex: ^(['"])(?:[a-zA-Z0-9_-]*(?:session|sid|sess|auth|token|jwt|refresh|access)[a-zA-Z0-9_-]*)\1$
+          - metavariable-pattern:
+              metavariable: $OPTS
+              patterns:
+                - pattern-either:
+                    - pattern: "{..., sameSite: 'none', ...}"
+                    - pattern: '{..., sameSite: "none", ...}'
+                    - pattern: "{..., sameSite: 'None', ...}"
+                    - pattern: '{..., sameSite: "None", ...}'
+                - pattern-not: '{..., secure: true, ...}'
+    fix: "$RES.cookie($NAME, $VAL, { ...$OPTS, sameSite: 'strict' })"
+    metadata:
+      oauthlint-rule-id: AUTH-COOKIE-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-samesite
+      category: security
+      cwe: CWE-1275
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - express
+        - fastify
+      references:
+        - https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-13#section-4.1.2.7

package/rules/cookie/no-secure.yml

@@ -0,0 +1,58 @@
+rules:
+  - id: auth.cookie.no-secure
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      A cookie that looks like a session or auth cookie is being set WITHOUT
+      the `Secure` flag. The browser will happily send it over plain HTTP,
+      which means a network attacker (open Wi-Fi, malicious proxy, downgrade
+      attack) can capture it.
+
+      Add `{ secure: true }` to the cookie options. If you absolutely need
+      to set Secure-less cookies in dev, gate it on `NODE_ENV !== 'production'`.
+    pattern-either:
+      - patterns:
+          - pattern: $RES.cookie($NAME, $VAL, $OPTS)
+          - metavariable-regex:
+              metavariable: $NAME
+              regex: ^(['"])(?:[a-zA-Z0-9_-]*(?:session|sid|sess|auth|token|jwt|refresh|access)[a-zA-Z0-9_-]*)\1$
+          - metavariable-pattern:
+              metavariable: $OPTS
+              patterns:
+                - pattern-not: '{..., secure: true, ...}'
+                - pattern-not: '{..., secure: $X, ...}'
+                - pattern: '{...}'
+      # Secure explicitly disabled — the exact bug, must fire (the `secure: $X`
+      # suppression above would otherwise treat `secure: false` as compliant).
+      - patterns:
+          - pattern: $RES.cookie($NAME, $VAL, $OPTS)
+          - metavariable-regex:
+              metavariable: $NAME
+              regex: ^(['"])(?:[a-zA-Z0-9_-]*(?:session|sid|sess|auth|token|jwt|refresh|access)[a-zA-Z0-9_-]*)\1$
+          - metavariable-pattern:
+              metavariable: $OPTS
+              pattern: '{..., secure: false, ...}'
+      - patterns:
+          - pattern: $RES.cookie($NAME, $VAL)
+          - metavariable-regex:
+              metavariable: $NAME
+              regex: ^(['"])(?:[a-zA-Z0-9_-]*(?:session|sid|sess|auth|token|jwt|refresh|access)[a-zA-Z0-9_-]*)\1$
+    # Auto-fix applies to the first (3-arg) pattern: spread the existing
+    # options object and inject secure:true. Verbose but always-correct;
+    # users can run prettier afterwards. The 2-arg branch is left alone
+    # because rewriting it requires inserting a brand-new argument.
+    fix: '$RES.cookie($NAME, $VAL, { ...$OPTS, secure: true })'
+    metadata:
+      oauthlint-rule-id: AUTH-COOKIE-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-secure
+      category: security
+      cwe: CWE-614
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      technology:
+        - express
+        - fastify
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.2.5

package/rules/cors/wildcard-with-credentials.yml

@@ -0,0 +1,56 @@
+rules:
+  - id: auth.cors.wildcard-with-credentials
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      CORS is configured with `Access-Control-Allow-Origin: *` and
+      `Access-Control-Allow-Credentials: true` at the same time. The
+      spec forbids this combination — browsers will block it — but
+      developers regularly try to "fix" the resulting error by switching
+      to `origin: true` (which echoes the requesting origin back),
+      effectively turning the policy into "allow credentials from
+      ANYWHERE". That's a CSRF-on-steroids primitive.
+
+      Decide which one you actually need:
+       - Public API, no cookies/auth headers needed cross-site →
+         `origin: '*'`, `credentials: false` (default).
+       - Authenticated API for a known frontend → enumerate the exact
+         origins, `credentials: true`.
+
+      Never combine wildcard origins with credentials enabled.
+    pattern-either:
+      # express cors() middleware — a wildcard ("*"), origin-echoing (true),
+      # request-reflected, or always-allow callback origin combined with
+      # credentials: true.
+      - patterns:
+          - pattern-either:
+              - pattern: 'cors({ ..., origin: "*", ..., credentials: true, ... })'
+              - pattern: 'cors({ ..., credentials: true, ..., origin: "*", ... })'
+              - pattern: 'cors({ ..., origin: true, ..., credentials: true, ... })'
+              - pattern: 'cors({ ..., credentials: true, ..., origin: true, ... })'
+              - pattern: 'cors({ ..., origin: $REQ.headers.origin, ..., credentials: true, ... })'
+              - pattern: 'cors({ ..., credentials: true, ..., origin: $REQ.headers.origin, ... })'
+              - pattern: 'cors({ ..., origin: ($O, $CB) => $CB(null, true), ..., credentials: true, ... })'
+              - pattern: 'cors({ ..., credentials: true, ..., origin: ($O, $CB) => $CB(null, true), ... })'
+      # Manual header writes: Access-Control-Allow-Origin: * together with
+      # Access-Control-Allow-Credentials: true (the two setHeader calls are
+      # always adjacent, so a bounded span regex catches both orders).
+      - pattern-regex: |-
+          Access-Control-Allow-Origin['"]\s*,\s*['"]\*['"][\s\S]{0,200}Access-Control-Allow-Credentials['"]\s*,\s*['"]true['"]
+      - pattern-regex: |-
+          Access-Control-Allow-Credentials['"]\s*,\s*['"]true['"][\s\S]{0,200}Access-Control-Allow-Origin['"]\s*,\s*['"]\*['"]
+    metadata:
+      oauthlint-rule-id: AUTH-CORS-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/cors-wildcard-with-credentials
+      category: security
+      cwe: CWE-942
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      technology:
+        - express
+        - cors
+      references:
+        - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
+        - https://portswigger.net/web-security/cors

package/rules/flow/insecure-random.yml

@@ -0,0 +1,56 @@
+rules:
+  - id: auth.flow.insecure-random
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      `Math.random()` is being assigned to (or used to compute) a value
+      whose name indicates it is security-sensitive — a token, a CSRF
+      value, an OAuth `state`, a session id, a nonce, or a verification
+      code. `Math.random()` is NOT cryptographically secure and is
+      predictable enough for an attacker with enough samples to recover
+      the seed.
+
+      Use `crypto.randomBytes(N)` (Node) or `crypto.getRandomValues()`
+      (browser) and base64url-encode the result.
+
+      OWASP ASVS V2.5: all security-sensitive random values must come
+      from a CSPRNG.
+    # `<... Math.random() ...>` deep-matches Math.random() anywhere in the
+    # initializer, covering the common token idioms:
+    #   Math.random().toString(36).slice(2) / .substring(2) / Math.floor(Math.random()*1e9)
+    # The name regex is case-insensitive (catches resetToken, csrfToken, …) and
+    # uses specific security words only — bare `code`/`sid` were removed because
+    # they matched barcode/zipcode/aside and produced false positives.
+    pattern-either:
+      - patterns:
+          - pattern: 'const $NAME = <... Math.random() ...>'
+          - metavariable-regex:
+              metavariable: $NAME
+              regex: (?i)^(?:[a-z][a-z0-9_]*)?(?:token|secret|csrf|nonce|sessionid|otp|verificationcode|verifycode|resetcode|apikey|password|salt)[a-z0-9_]*$
+      - patterns:
+          - pattern: 'let $NAME = <... Math.random() ...>'
+          - metavariable-regex:
+              metavariable: $NAME
+              regex: (?i)^(?:[a-z][a-z0-9_]*)?(?:token|secret|csrf|nonce|sessionid|otp|verificationcode|verifycode|resetcode|apikey|password|salt)[a-z0-9_]*$
+      - patterns:
+          - pattern: 'var $NAME = <... Math.random() ...>'
+          - metavariable-regex:
+              metavariable: $NAME
+              regex: (?i)^(?:[a-z][a-z0-9_]*)?(?:token|secret|csrf|nonce|sessionid|otp|verificationcode|verifycode|resetcode|apikey|password|salt)[a-z0-9_]*$
+      - patterns:
+          - pattern: '$OBJ.$NAME = <... Math.random() ...>'
+          - metavariable-regex:
+              metavariable: $NAME
+              regex: (?i)^(?:[a-z][a-z0-9_]*)?(?:token|secret|csrf|nonce|sessionid|otp|verificationcode|verifycode|resetcode|apikey|password|salt)[a-z0-9_]*$
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-insecure-random
+      category: security
+      cwe: CWE-338
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/338.html

package/rules/flow/no-rate-limit.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.flow.no-rate-limit
+    languages:
+      - javascript
+      - typescript
+    severity: INFO
+    message: |
+      A `/login`, `/signin`, `/auth`, or `/reset-password` POST handler is
+      registered without any rate-limit middleware in scope. Without a
+      rate limit, credential-stuffing and brute-force attacks are
+      essentially free for the attacker.
+
+      Add `express-rate-limit`, `@fastify/rate-limit`, or a gateway-level
+      WAF rule. Per-IP + per-account is the typical pairing.
+    # 2-argument route registration (path, handler) on any router-like object
+    # (app / router / fastify / …) whose path looks like an auth endpoint. The
+    # 2-arg form means no middleware is in the chain; adding rate-limit
+    # middleware uses the 3+-arg form (or fastify's options object) and so is
+    # not flagged. Path matching is a regex, so `/api/login`, `/v1/auth`,
+    # `/auth/signin` etc. are all covered.
+    # NOTE: app-level rate limiting (`app.use(rateLimit())`) is invisible to a
+    # purely syntactic rule — hence INFO severity.
+    patterns:
+      - pattern: '$APP.post($PATH, $HANDLER)'
+      - metavariable-regex:
+          metavariable: $PATH
+          regex: ^['"][^'"]*\/(?:login|signin|sign-in|signup|sign-up|authenticate|auth|reset-password|forgot-password)(?![a-z-])[^'"]*['"]$
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-no-rate-limit
+      category: security
+      cwe: CWE-307
+      owasp: API4:2023
+      llm-prevalence: HIGH
+      technology:
+        - express
+        - fastify
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html

package/rules/flow/password-min-length.yml

@@ -0,0 +1,44 @@
+rules:
+  - id: auth.flow.password-min-length
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      A password validation schema is enforcing a minimum length of less
+      than 8 characters. NIST SP 800-63B recommends ≥ 8 characters for
+      user-chosen passwords (with NO mandatory complexity rules — length
+      is the dominant strength factor). OWASP ASVS V2.1.1 requires ≥ 12
+      for high-assurance applications.
+
+      Common LLM-generated mistake: `password: z.string().min(6)` because
+      "6 looks reasonable" — it isn't. Bump the floor to 8 minimum, 12
+      preferred.
+    pattern-either:
+      - patterns:
+          # `$Z.string()` covers z./Joi./yup.; the 2-arg form catches the
+          # common `.min(6, 'too short')` custom-message style.
+          - pattern-either:
+              - pattern: '$Z.string().min($N)'
+              - pattern: '$Z.string().min($N, ...)'
+          - metavariable-comparison:
+              metavariable: $N
+              comparison: $N < 8
+          - pattern-inside: |
+              { ..., password: ..., ... }
+      - patterns:
+          - pattern-regex: \b(?:password|pwd)\s*\.\s*length\s*[<≤]=?\s*[1-7]\b
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-password-min-length
+      category: security
+      cwe: CWE-521
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - zod
+        - joi
+        - yup
+      references:
+        - https://pages.nist.gov/800-63-3/sp800-63b.html
+        - https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html

package/rules/flow/password-plaintext.yml

@@ -0,0 +1,82 @@
+rules:
+  - id: auth.flow.password-plaintext
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      A user-supplied password is being persisted WITHOUT being hashed first.
+      Storing plaintext passwords means any database read (backup, SQL injection,
+      misconfigured backup, contractor with read-only access) leaks every
+      credential in one shot.
+
+      Hash with argon2id (recommended), bcrypt, or scrypt before persisting.
+      Never use plain SHA-256, MD5, or any unsalted hash for passwords.
+
+      OWASP ASVS V2.4 mandates an adaptive, salted hash. Every modern stack
+      ships one — there is no reason to roll your own.
+    pattern-either:
+      # Flat persistence object on a user-ish model/repo:
+      # db.users.create({password}), User.create({password}), userRepo.save({password}),
+      # new User({password}), prisma.user.insertOne({password}), …
+      - patterns:
+          - pattern-either:
+              - pattern: '$DB.$MODEL.create({..., password: $PWD, ...})'
+              - pattern: '$DB.$MODEL.insert({..., password: $PWD, ...})'
+              - pattern: '$DB.$MODEL.insertOne({..., password: $PWD, ...})'
+              - pattern: '$DB.$MODEL.save({..., password: $PWD, ...})'
+              - pattern: '$MODEL.create({..., password: $PWD, ...})'
+              - pattern: '$MODEL.insert({..., password: $PWD, ...})'
+              - pattern: '$MODEL.save({..., password: $PWD, ...})'
+              - pattern: 'new $MODEL({..., password: $PWD, ...})'
+          - metavariable-regex:
+              metavariable: $MODEL
+              regex: '(?i)user'
+          - metavariable-pattern:
+              metavariable: $PWD
+              patterns:
+                - pattern-not: '$X.hash(...)'
+                - pattern-not: 'hash($X, ...)'
+                - pattern-not: 'bcrypt.$Y(...)'
+                - pattern-not: 'argon2.$Y(...)'
+                - pattern-not: 'scrypt.$Y(...)'
+                - pattern-not: 'crypto.scrypt(...)'
+                - pattern-not: 'await $X.hash(...)'
+                - pattern-not: 'await hash($X, ...)'
+          # Don't flag a value whose name says it is already hashed
+          # (hashedPassword, passwordHash, …) — the common pre-hash idiom.
+          - metavariable-regex:
+              metavariable: $PWD
+              regex: '(?i)^(?!.*hash).*$'
+      # Prisma-style nested data wrapper: prisma.user.create({ data: { password } }).
+      - patterns:
+          - pattern-either:
+              - pattern: '$DB.$MODEL.create({..., data: {..., password: $PWD, ...}, ...})'
+              - pattern: '$DB.$MODEL.update({..., data: {..., password: $PWD, ...}, ...})'
+          - metavariable-regex:
+              metavariable: $MODEL
+              regex: '(?i)user'
+          - metavariable-pattern:
+              metavariable: $PWD
+              patterns:
+                - pattern-not: '$X.hash(...)'
+                - pattern-not: 'hash($X, ...)'
+                - pattern-not: 'bcrypt.$Y(...)'
+                - pattern-not: 'argon2.$Y(...)'
+                - pattern-not: 'scrypt.$Y(...)'
+                - pattern-not: 'crypto.scrypt(...)'
+                - pattern-not: 'await $X.hash(...)'
+                - pattern-not: 'await hash($X, ...)'
+          - metavariable-regex:
+              metavariable: $PWD
+              regex: '(?i)^(?!.*hash).*$'
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/password-plaintext
+      category: security
+      cwe: CWE-256
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/256.html

package/rules/flow/timing-unsafe-compare.yml

@@ -0,0 +1,103 @@
+rules:
+  - id: auth.flow.timing-unsafe-compare
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      A secret-shaped value (`password`, `token`, `secret`, `apiKey`,
+      `csrf`, `hmac`) is being compared with `===` / `!==` /
+      `string1 == string2`. JavaScript's equality operators short-circuit
+      on the first differing byte, which leaks the matching prefix
+      length over the wire — a classic timing-attack vector.
+
+      Use `crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b))` (both
+      buffers must be the same length, so hash first if needed). For
+      password verification, use `argon2.verify`, `bcrypt.compare`, or
+      `scrypt` — they handle constant-time comparison for you.
+    # We want to catch `secretVar === userInput` but NOT the dozens of
+    # legitimate non-secret comparisons that just happen to involve a
+    # variable whose name ends with one of our secret-looking suffixes:
+    #   typeof token === 'string'          (type check)
+    #   signature !== ''                   (presence check)
+    #   parts.length === 3                 (shape check)
+    #   token.length === expectedLength    (length check)
+    # The pattern-not clauses below carve those out — they were the
+    # entirety of the FP class we saw on jose / next-auth in validation.
+    pattern-either:
+      - patterns:
+          - pattern-either:
+              - pattern: '$A === $B'
+              - pattern: '$A !== $B'
+              - pattern: '$A == $B'
+              - pattern: '$A != $B'
+          - metavariable-regex:
+              metavariable: $A
+              regex: (?i)^.*(?:password|secret|token|apikey|api_key|csrf|hmac|signature)$
+          - pattern-not: 'typeof $X === $Y'
+          - pattern-not: 'typeof $X !== $Y'
+          - pattern-not: 'typeof $X == $Y'
+          - pattern-not: 'typeof $X != $Y'
+          - pattern-not: '$X === ""'
+          - pattern-not: "$X === ''"
+          - pattern-not: '$X !== ""'
+          - pattern-not: "$X !== ''"
+          - pattern-not: '$X == ""'
+          - pattern-not: "$X == ''"
+          - pattern-not: '$X != ""'
+          - pattern-not: "$X != ''"
+          - pattern-not: '$X.length === $N'
+          - pattern-not: '$X.length !== $N'
+          - pattern-not: '$X.length == $N'
+          - pattern-not: '$X.length != $N'
+          - pattern-not: '$X === null'
+          - pattern-not: '$X !== null'
+          - pattern-not: '$X == null'
+          - pattern-not: '$X != null'
+          - pattern-not: '$X === undefined'
+          - pattern-not: '$X !== undefined'
+          - pattern-not: '$X == undefined'
+          - pattern-not: '$X != undefined'
+      - patterns:
+          - pattern-either:
+              - pattern: '$A === $B'
+              - pattern: '$A !== $B'
+              - pattern: '$A == $B'
+              - pattern: '$A != $B'
+          - metavariable-regex:
+              metavariable: $B
+              regex: (?i)^.*(?:password|secret|token|apikey|api_key|csrf|hmac|signature)$
+          - pattern-not: 'typeof $X === $Y'
+          - pattern-not: 'typeof $X !== $Y'
+          - pattern-not: 'typeof $X == $Y'
+          - pattern-not: 'typeof $X != $Y'
+          - pattern-not: '$X === ""'
+          - pattern-not: "$X === ''"
+          - pattern-not: '$X !== ""'
+          - pattern-not: "$X !== ''"
+          - pattern-not: '$X == ""'
+          - pattern-not: "$X == ''"
+          - pattern-not: '$X != ""'
+          - pattern-not: "$X != ''"
+          - pattern-not: '$X.length === $N'
+          - pattern-not: '$X.length !== $N'
+          - pattern-not: '$X.length == $N'
+          - pattern-not: '$X.length != $N'
+          - pattern-not: '$X === null'
+          - pattern-not: '$X !== null'
+          - pattern-not: '$X == null'
+          - pattern-not: '$X != null'
+          - pattern-not: '$X === undefined'
+          - pattern-not: '$X !== undefined'
+          - pattern-not: '$X == undefined'
+          - pattern-not: '$X != undefined'
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-timing-unsafe-compare
+      category: security
+      cwe: CWE-208
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
+        - https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b

package/rules/jwt/alg-none.yml

@@ -0,0 +1,46 @@
+rules:
+  - id: auth.jwt.alg-none
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      JWTs are being verified with the `none` algorithm in the allowed list.
+      An attacker can forge any token by simply setting `alg: none` in the header
+      and supplying no signature, because the verification routine will accept it.
+
+      Restrict `algorithms` to the ones you actually use, e.g. ["RS256"] or ["ES256"].
+      Never include "none" or "None" in production code paths.
+
+      RFC 7518 §3.6 explicitly warns: "Implementations SHOULD NOT support the
+      'none' algorithm in deployed systems."
+    # Scoped to `jsonwebtoken` (alias `jwt`) — generic $X.verify
+    # produced FPs on jose internals and re-exported test helpers.
+    pattern-either:
+      - pattern: 'jwt.verify($TOKEN, $SECRET, { ..., algorithms: [..., "none", ...], ... })'
+      - pattern: 'jwt.verify($TOKEN, $SECRET, { ..., algorithms: [..., "None", ...], ... })'
+      - pattern: 'jwt.verify($TOKEN, $SECRET, { ..., algorithms: [..., "NONE", ...], ... })'
+      - pattern: 'jwt.decode($TOKEN, { complete: true, algorithms: [..., "none", ...] })'
+      # Destructured import: `import { verify } from 'jsonwebtoken'`. Scoped to
+      # the import so a bare verify() from another library is not matched.
+      - patterns:
+          - pattern-inside: |
+              import { ..., verify, ... } from 'jsonwebtoken'
+              ...
+          - pattern-either:
+              - pattern: 'verify($TOKEN, $SECRET, { ..., algorithms: [..., "none", ...], ... })'
+              - pattern: 'verify($TOKEN, $SECRET, { ..., algorithms: [..., "None", ...], ... })'
+              - pattern: 'verify($TOKEN, $SECRET, { ..., algorithms: [..., "NONE", ...], ... })'
+    metadata:
+      oauthlint-rule-id: AUTH-JWT-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/jwt-alg-none
+      category: security
+      cwe: CWE-327
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      technology:
+        - jsonwebtoken
+        - jose
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.6
+        - https://owasp.org/www-project-api-security/

package/rules/jwt/algorithm-confusion.yml

@@ -0,0 +1,67 @@
+rules:
+  - id: auth.jwt.algorithm-confusion
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      A JWT is being verified with HS256 (a symmetric algorithm) but the
+      key looks like an RSA / EC public key in PEM format. This is the
+      "algorithm confusion" attack: an attacker can sign forged tokens
+      with the public key and your code will happily verify them with
+      HMAC-SHA256 treating the PEM string as the shared secret.
+
+      Always pin the algorithm to the asymmetric one you actually use
+      (e.g. `algorithms: ['RS256']`) and pass the public key only when
+      verifying asymmetric tokens.
+
+      RFC 7518 §3.1 — the "alg" header must be matched to the key type.
+    # Algorithm confusion = verifying with an HMAC algorithm (HS*) while the key
+    # is an asymmetric PUBLIC key — the attacker signs with HS* using the public
+    # key as the shared secret. We match either an inline PEM literal OR a key
+    # bound to a public-key-named variable (the common real-world shape), in
+    # both cases combined with an HS* algorithm.
+    pattern-either:
+      - patterns:
+          - pattern: 'jwt.verify($TOKEN, $KEY, $OPTS)'
+          - metavariable-regex:
+              metavariable: $KEY
+              regex: '-----BEGIN [A-Z ]*PUBLIC KEY-----'
+          - metavariable-pattern:
+              metavariable: $OPTS
+              patterns:
+                - pattern-either:
+                    - pattern: '{..., algorithms: ["HS256", ...], ...}'
+                    - pattern: '{..., algorithms: ["HS384", ...], ...}'
+                    - pattern: '{..., algorithms: ["HS512", ...], ...}'
+      - patterns:
+          - pattern: 'jwt.verify($TOKEN, $KEY)'
+          - metavariable-regex:
+              metavariable: $KEY
+              regex: '-----BEGIN [A-Z ]*PUBLIC KEY-----'
+      # Key is a public-key-named variable (RSA_PUBLIC, publicKey, pubKey, …)
+      # verified with an HS* algorithm.
+      - patterns:
+          - pattern: 'jwt.verify($TOKEN, $KEY, $OPTS)'
+          - metavariable-regex:
+              metavariable: $KEY
+              regex: '(?i).*pub(lic)?'
+          - metavariable-pattern:
+              metavariable: $OPTS
+              patterns:
+                - pattern-either:
+                    - pattern: '{..., algorithms: ["HS256", ...], ...}'
+                    - pattern: '{..., algorithms: ["HS384", ...], ...}'
+                    - pattern: '{..., algorithms: ["HS512", ...], ...}'
+    metadata:
+      oauthlint-rule-id: AUTH-JWT-007
+      oauthlint-doc-url: https://oauthlint.dev/rules/jwt-algorithm-confusion
+      category: security
+      cwe: CWE-327
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - jsonwebtoken
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.1
+        - https://owasp.org/www-project-api-security/

package/rules/jwt/in-url.yml

@@ -0,0 +1,33 @@
+rules:
+  - id: auth.jwt.in-url
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      A JWT-looking value (header `eyJ…`) appears in a URL query string
+      or fragment. URLs leak into server logs, browser history, the
+      `Referer` header (sent to every third-party CDN, ad pixel, and
+      analytics script on the destination page), and even copy-paste
+      operations. A JWT in a URL is a leaked JWT.
+
+      Send JWTs in the `Authorization: Bearer …` header, or in a
+      `Secure; HttpOnly; SameSite` cookie. Never in the URL.
+
+      OWASP ASVS V3.2.3 explicitly forbids credentials in URL parameters.
+    pattern-either:
+      # JWT in a query parameter or fragment.
+      - pattern-regex: '[?&][^=]+=eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
+      - pattern-regex: "#[^=]+=eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+"
+      # JWT embedded in a URL path segment (e.g. /verify/eyJ...). The eyJ.x.y
+      # shape is JWT-specific, so this stays low-FP.
+      - pattern-regex: '/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
+    metadata:
+      oauthlint-rule-id: AUTH-JWT-008
+      oauthlint-doc-url: https://oauthlint.dev/rules/jwt-in-url
+      category: security
+      cwe: CWE-598
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      references:
+        - https://owasp.org/www-project-application-security-verification-standard/