oauthlint-rules 0.1.0

package/rules/jwt/localstorage.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.jwt.localstorage
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      A JWT (or other auth token) is being written to `localStorage`. Any
+      XSS that lands on the page can exfiltrate the token via
+      `localStorage.getItem(...)` — and unlike `HttpOnly` cookies, there
+      is no browser-side mitigation.
+
+      Store auth tokens in an `HttpOnly; Secure; SameSite=Strict` cookie
+      set by the server, or in memory only. `sessionStorage` is no safer
+      against XSS — it's the same attacker capability.
+
+      OWASP ASVS V3.4: tokens must not be stored where untrusted scripts
+      can read them.
+    # The key must contain a strong token word (`token` catches accessToken,
+    # refresh_token, authToken, idToken, sessionToken, …). We deliberately do
+    # NOT match the bare words `auth`/`access`/`refresh`/`session` because they
+    # appear as substrings of innocuous keys (author_filter, auto_refresh,
+    # access_count, sidebar_session) and produced false positives.
+    pattern-either:
+      - patterns:
+          - pattern-regex: |-
+              (?:window\.|globalThis\.|self\.)?(?:localStorage|sessionStorage)\.setItem\(\s*['"][^'"]*(?i:token|jwt|bearer|credential|api[_-]?key)[^'"]*['"]
+      - patterns:
+          - pattern-regex: |-
+              (?:window\.|globalThis\.|self\.)?(?:localStorage|sessionStorage)\[\s*['"][^'"]*(?i:token|jwt|bearer|credential|api[_-]?key)[^'"]*['"]\s*\]\s*=
+    metadata:
+      oauthlint-rule-id: AUTH-JWT-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/jwt-localstorage
+      category: security
+      cwe: CWE-922
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html

package/rules/jwt/no-audience.yml

@@ -0,0 +1,49 @@
+rules:
+  - id: auth.jwt.no-audience
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      JWT is being verified without checking the `aud` (audience) claim.
+      A token issued for one of your services (e.g. an internal worker)
+      can then be replayed against another service that trusts the same
+      key, leading to confused-deputy attacks.
+
+      Pass `{ audience: 'your-api' }` to `jwt.verify` (or validate the
+      `aud` claim manually) on every verification path.
+
+      RFC 7519 §4.1.3 defines the `aud` claim explicitly for this use case.
+    # Scoped to the `jsonwebtoken` library by matching the common alias
+    # `jwt` (the literal identifier 99% of users pick). Generic `X.verify(...)`
+    # calls on unrelated libs (jose internals, custom signers) no longer
+    # fire — this was the dominant FP class in real-world validation.
+    pattern-either:
+      - patterns:
+          - pattern: 'jwt.verify($TOKEN, $SECRET, $OPTS)'
+          - metavariable-pattern:
+              metavariable: $OPTS
+              patterns:
+                - pattern-not: '{..., audience: ..., ...}'
+                - pattern: '{...}'
+      # Callback form: jwt.verify(token, secret, options, cb) without audience.
+      - patterns:
+          - pattern: 'jwt.verify($TOKEN, $SECRET, $OPTS, $CB)'
+          - metavariable-pattern:
+              metavariable: $OPTS
+              patterns:
+                - pattern-not: '{..., audience: ..., ...}'
+                - pattern: '{...}'
+      - patterns:
+          - pattern: 'jwt.verify($TOKEN, $SECRET)'
+    metadata:
+      oauthlint-rule-id: AUTH-JWT-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/jwt-no-audience
+      category: security
+      cwe: CWE-345
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - jsonwebtoken
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3

package/rules/jwt/no-expiration.yml

@@ -0,0 +1,45 @@
+rules:
+  - id: auth.jwt.no-expiration
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      JWT is signed without any `expiresIn` / `exp` claim, OR a token is
+      verified without an `maxAge` check. A stolen token therefore remains
+      valid forever.
+
+      Always set a reasonable expiration on access tokens (5-60 minutes is
+      typical) and verify it with `{ maxAge: '15m' }` or by validating the
+      `exp` claim explicitly.
+    # Scoped to the `jsonwebtoken` library by matching the common alias
+    # `jwt`. Generic `X.sign(...)` calls on unrelated libs (jose
+    # internals, custom signers, ECDSA primitives) no longer fire —
+    # this was the dominant FP class in real-world validation.
+    pattern-either:
+      - patterns:
+          - pattern: 'jwt.sign($PAYLOAD, $SECRET)'
+          - pattern-not: 'jwt.sign({..., exp: ..., ...}, $SECRET)'
+          - pattern-not: 'jwt.sign({..., expiresIn: ..., ...}, $SECRET)'
+      - patterns:
+          - pattern: 'jwt.sign($PAYLOAD, $SECRET, $OPTS)'
+          # exp can live in the payload too, not only the options object.
+          - pattern-not: 'jwt.sign({..., exp: ..., ...}, $SECRET, $OPTS)'
+          - pattern-not: 'jwt.sign({..., expiresIn: ..., ...}, $SECRET, $OPTS)'
+          - metavariable-pattern:
+              metavariable: $OPTS
+              patterns:
+                - pattern-not: '{..., expiresIn: ..., ...}'
+                - pattern-not: '{..., exp: ..., ...}'
+                - pattern: '{...}'
+    metadata:
+      oauthlint-rule-id: AUTH-JWT-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/jwt-no-expiration
+      category: security
+      cwe: CWE-613
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      technology:
+        - jsonwebtoken
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4

package/rules/jwt/no-issuer.yml

@@ -0,0 +1,40 @@
+rules:
+  - id: auth.jwt.no-issuer
+    languages:
+      - javascript
+      - typescript
+    severity: INFO
+    message: |
+      JWT is being verified without checking the `iss` (issuer) claim. If
+      your verification key is shared across multiple authorization
+      servers (or even tenants on a single IdP), this lets a token signed
+      by one issuer be accepted by code that was meant to trust another.
+
+      Pass `{ issuer: 'https://your-idp.example.com' }` to `jwt.verify` so
+      that the trust chain is explicit. RFC 7519 §4.1.1 defines the
+      `iss` claim for exactly this purpose.
+    # Scoped to `jsonwebtoken` (alias `jwt`) for the same reason as
+    # auth.jwt.no-audience: generic $X.verify() patterns produced too
+    # many FPs on jose/custom signer code.
+    pattern-either:
+      - patterns:
+          - pattern: 'jwt.verify($TOKEN, $SECRET, $OPTS)'
+          - metavariable-pattern:
+              metavariable: $OPTS
+              patterns:
+                - pattern-not: '{..., issuer: ..., ...}'
+                - pattern: '{...}'
+      # 2-arg verify has no options at all → no issuer check (parity with
+      # auth.jwt.no-audience).
+      - pattern: 'jwt.verify($TOKEN, $SECRET)'
+    metadata:
+      oauthlint-rule-id: AUTH-JWT-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/jwt-no-issuer
+      category: security
+      cwe: CWE-345
+      owasp: API2:2023
+      llm-prevalence: LOW
+      technology:
+        - jsonwebtoken
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1

package/rules/jwt/weak-secret.yml

@@ -0,0 +1,56 @@
+rules:
+  - id: auth.jwt.weak-secret
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      JWT signing or verification uses a hard-coded secret. Anyone who reads
+      the source (including via leaked GitHub commits) can forge valid tokens.
+
+      Move the secret to an environment variable or secret manager, and ensure
+      the value is at least 256 bits (32 ASCII characters) when using HMAC-based
+      algorithms (HS256/HS384/HS512).
+
+      Real-world incident: 24,008 unique secrets were found in MCP config files
+      and 3.2% of Claude Code commits leaked secrets in GitGuardian's 2026 report.
+    # Scoped to the `jsonwebtoken` alias `jwt` to avoid matching jose's
+    # low-level `sig.sign(key, options)` and similar generic patterns
+    # that were the FP class in real-world validation.
+    pattern-either:
+      - patterns:
+          - pattern-either:
+              - pattern: 'jwt.sign($PAYLOAD, $SECRET)'
+              - pattern: 'jwt.sign($PAYLOAD, $SECRET, ...)'
+              - pattern: 'jwt.verify($TOKEN, $SECRET)'
+              - pattern: 'jwt.verify($TOKEN, $SECRET, ...)'
+          - metavariable-regex:
+              metavariable: $SECRET
+              regex: ^(["'])(?:[a-zA-Z0-9!._-]{1,20}|secret|password|changeme|jwt[-_]?secret|my[-_]?secret)\1$
+      # Destructured import: `import { sign, verify } from 'jsonwebtoken'`.
+      # Scoped to the import so bare sign()/verify() from other libraries are
+      # not matched.
+      - patterns:
+          - pattern-inside: |
+              import { ... } from 'jsonwebtoken'
+              ...
+          - pattern-either:
+              - pattern: 'sign($PAYLOAD, $SECRET)'
+              - pattern: 'sign($PAYLOAD, $SECRET, ...)'
+              - pattern: 'verify($TOKEN, $SECRET)'
+              - pattern: 'verify($TOKEN, $SECRET, ...)'
+          - metavariable-regex:
+              metavariable: $SECRET
+              regex: ^(["'])(?:[a-zA-Z0-9!._-]{1,20}|secret|password|changeme|jwt[-_]?secret|my[-_]?secret)\1$
+    metadata:
+      oauthlint-rule-id: AUTH-JWT-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/jwt-weak-secret
+      category: security
+      cwe: CWE-798
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      technology:
+        - jsonwebtoken
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.2
+        - https://cwe.mitre.org/data/definitions/798.html

package/rules/oauth/broad-scope.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.oauth.broad-scope
+    languages:
+      - javascript
+      - typescript
+    severity: INFO
+    message: |
+      OAuth scope request includes an over-broad scope such as `admin`,
+      `full_access`, `*`, or `repo` (entire GitHub access). LLMs default
+      to the widest scope that "works", but every extra scope expands
+      the blast radius if the access token is leaked or replayed.
+
+      Request the narrowest scope that satisfies your feature. Examples:
+      use `repo:status` instead of `repo`, `gmail.send` instead of
+      `https://mail.google.com/`, and scope down to `read:user` when you
+      only need a profile.
+    # An over-broad scope must be a STANDALONE token (bounded by the quote, a
+    # space, or a comma — OAuth scopes are space-delimited). Structured
+    # sub-scopes such as `admin:read`, `repo:status`, `public_repo`,
+    # `channels:admin`, `calendar.all` are narrower and intentionally NOT
+    # flagged (they previously matched via `\b` and produced false positives).
+    pattern-either:
+      - pattern-regex: |-
+              scope\s*[:=]\s*(['"])(?:[^'"]*[ ,])?(?:admin|full_access|all|root|superuser|repo)(?:[ ,][^'"]*)?\1
+      - pattern-regex: |-
+              scope\s*[:=]\s*['"][^'"]*\*[^'"]*['"]
+      - pattern-regex: |-
+              scope\s*[:=]\s*['"][^'"]*https://mail\.google\.com/[^'"]*['"]
+      - pattern-regex: |-
+              scopes?\s*[:=]\s*\[[^\]]*(['"])(?:[^'"]*[ ,])?(?:admin|full_access|all|root|superuser|repo)(?:[ ,][^'"]*)?\1[^\]]*\]
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-broad-scope
+      category: security
+      cwe: CWE-272
+      owasp: API1:2023
+      llm-prevalence: HIGH
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.3

package/rules/oauth/hardcoded-secret.yml

@@ -0,0 +1,41 @@
+rules:
+  - id: auth.oauth.hardcoded-secret
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      An OAuth `client_secret` (or similarly sensitive credential) is being
+      assigned a hard-coded string literal. The moment this lands in git, it
+      is one search away from compromise.
+
+      Replace the literal with `process.env.OAUTH_CLIENT_SECRET` (or your
+      secret manager equivalent) and add the variable to `.env.example` with
+      a placeholder so contributors know it is required.
+
+      GitGuardian 2026 found 28.6M public secrets on GitHub, with Claude Code
+      commits leaking at 2x baseline. This is the most common AI-coding leak.
+    # Key matching is case-insensitive (client_secret / clientSecret /
+    # CLIENT_SECRET). The value must be a quoted ≥8-char literal, so `process.env`
+    # references never match. Env-var template strings, <placeholders>, and
+    # obvious doc/test placeholders are excluded to avoid false positives.
+    pattern-either:
+      - patterns:
+          - pattern-regex: |-
+              (?i)client[_-]?secret\s*[:=]\s*['"][^'"\s]{8,}['"]
+          - pattern-not-regex: |-
+              (?i)client[_-]?secret\s*[:=]\s*['"]\$\{?[A-Za-z_]+\}?['"]
+          - pattern-not-regex: |-
+              (?i)client[_-]?secret\s*[:=]\s*['"]<[^'"]*>['"]
+          - pattern-not-regex: |-
+              (?i)client[_-]?secret\s*[:=]\s*['"](?:your[-_]|my[-_]|example|placeholder|xxx+|todo|fixme|test|dummy|fake|sample|changeme|redacted)
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-hardcoded-secret
+      category: security
+      cwe: CWE-798
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1
+        - https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/

package/rules/oauth/implicit-flow.yml

@@ -0,0 +1,36 @@
+rules:
+  - id: auth.oauth.implicit-flow
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      OAuth implicit flow (`response_type=token` or `response_type=id_token
+      token`) is deprecated by OAuth 2.0 Security BCP (RFC 9700) and the
+      OAuth 2.1 working draft. The access token leaks into the URL
+      fragment, browser history, and referrer headers, and there is no
+      refresh-token mechanism.
+
+      Migrate to authorization code + PKCE (`response_type=code` with a
+      `code_challenge`). All modern OAuth providers (Google, Microsoft,
+      Auth0, Okta, Keycloak, WSO2) support this for SPAs and native apps.
+    pattern-either:
+      - pattern-regex: |-
+              response_type\s*[:=]\s*['"]token['"]
+      - pattern-regex: |-
+              response_type\s*[:=]\s*['"]id_token\s+token['"]
+      - pattern-regex: |-
+              response_type\s*[:=]\s*['"]token\s+id_token['"]
+      - pattern-regex: |-
+              [?&]response_type=token(?:&|['"]|#|$)
+      - pattern-regex: |-
+              [?&]response_type=(?:id_token(?:%20|\+)token|token(?:%20|\+)id_token)(?:&|['"]|#|$)
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-implicit-flow
+      category: security
+      cwe: CWE-1004
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700

package/rules/oauth/long-token-lifetime.yml

@@ -0,0 +1,57 @@
+rules:
+  - id: auth.oauth.long-token-lifetime
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      An OAuth `expires_in` (or comparable token-lifetime field) is being
+      set to a literal value greater than 86_400 seconds — i.e. longer
+      than 24 hours. Long-lived access tokens make every token theft
+      catastrophic because they remain valid for days or weeks; the
+      industry standard is 15-60 minutes for access tokens, paired with
+      a refresh-token rotation flow for longer sessions.
+
+      Don't issue access tokens longer than a day. Use refresh tokens
+      with proper rotation (RFC 6749 §6, RFC 9700 §4.14) for "stay
+      logged in" semantics.
+    pattern-either:
+      # Numeric literal as an object property.
+      - patterns:
+          - pattern-either:
+              - pattern: '{ ..., expires_in: $TTL, ... }'
+              - pattern: '{ ..., expiresIn: $TTL, ... }'
+              - pattern: '{ ..., access_token_ttl: $TTL, ... }'
+              - pattern: '{ ..., accessTokenTtl: $TTL, ... }'
+              - pattern: '{ ..., tokenLifetime: $TTL, ... }'
+          - metavariable-comparison:
+              metavariable: $TTL
+              comparison: $TTL > 86400
+      # Numeric literal via member assignment (config.expires_in = N).
+      - patterns:
+          - pattern-either:
+              - pattern: '$X.expires_in = $TTL'
+              - pattern: '$X.expiresIn = $TTL'
+              - pattern: '$X.access_token_ttl = $TTL'
+              - pattern: '$X.accessTokenTtl = $TTL'
+              - pattern: '$X.tokenLifetime = $TTL'
+          - metavariable-comparison:
+              metavariable: $TTL
+              comparison: $TTL > 86400
+      # jsonwebtoken / `ms`-style string durations longer than a day: >=2 days,
+      # or any weeks / months / years. ('1d', '15m', '12h' are <= 24h and are
+      # intentionally not matched.)
+      - pattern-regex: |-
+          (?:expiresIn|expires_in)\s*[:=]\s*['"](?:[2-9]|[1-9][0-9]+)\s*(?:d|days?)['"]
+      - pattern-regex: |-
+          (?:expiresIn|expires_in)\s*[:=]\s*['"][1-9][0-9]*\s*(?:w|y|weeks?|years?|months?)['"]
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-009
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-long-token-lifetime
+      category: security
+      cwe: CWE-613
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-4.14
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-6

package/rules/oauth/no-pkce.yml

@@ -0,0 +1,50 @@
+rules:
+  - id: auth.oauth.no-pkce
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      OAuth 2.0 authorization request looks like a public client (SPA,
+      mobile, or native app) but does not include a `code_challenge`
+      parameter. Without PKCE, the authorization code can be intercepted
+      and exchanged by an attacker.
+
+      RFC 8252 §6 mandates PKCE for native/SPA clients. RFC 9700 (OAuth 2.0
+      Security BCP) recommends PKCE for ALL clients, including confidential
+      ones, as defence in depth.
+
+      Generate a `code_verifier` (43-128 char), derive `code_challenge =
+      BASE64URL-NoPad(SHA256(code_verifier))`, send it with
+      `code_challenge_method=S256` on the authorize call, and POST the
+      `code_verifier` on the token call.
+    pattern-either:
+      # Inline authorize URL — any provider's authorize endpoint carrying an
+      # authorization-code request (client_id + response_type=code) with no
+      # code_challenge. The path is not hardcoded (Google uses /o/oauth2/v2/auth,
+      # Auth0/Okta /authorize, GitHub /oauth/authorize, …).
+      - patterns:
+          - pattern-regex: |-
+              ['"]https?://[^'"\s]+\?[^'"]*response_type=code[^'"]*['"]
+          - pattern-regex: |-
+              client_id=
+          - pattern-not-regex: |-
+              code_challenge
+      # Programmatic URLSearchParams build (AST object match — robust to key
+      # order and object length, unlike a char-window regex).
+      - patterns:
+          - pattern: 'new URLSearchParams({..., client_id: $C, ...})'
+          - pattern-either:
+              - pattern: "new URLSearchParams({..., response_type: 'code', ...})"
+              - pattern: 'new URLSearchParams({..., response_type: "code", ...})'
+          - pattern-not: 'new URLSearchParams({..., code_challenge: $X, ...})'
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-no-pkce
+      category: security
+      cwe: CWE-345
+      owasp: API1:2023
+      llm-prevalence: HIGH
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc7636
+        - https://datatracker.ietf.org/doc/html/rfc8252#section-6

package/rules/oauth/no-state-validation.yml

@@ -0,0 +1,42 @@
+rules:
+  - id: auth.oauth.no-state-validation
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      OAuth callback handler reads `state` from the request but never
+      compares it to a stored value. Sending `state` on the authorize
+      call is half of the CSRF mitigation; verifying it on the callback
+      is the other half.
+
+      Compare the received `state` to the value you stored before
+      redirecting (session, signed cookie, or Redis). Reject the callback
+      if it's missing or doesn't match.
+    # Suppress when the received `state` is referenced inside ANY `if`
+    # condition — that's the validation. The deep-expression operator
+    # `<... state ...>` makes this order-agnostic and helper-aware, so
+    # `if (req.query.state !== stored)`, `if (stored === req.query.state)`, and
+    # `if (!verifyState(req.query.state))` are all treated as safe (the previous
+    # exact-shape patterns only matched one operand order → false positives).
+    pattern-either:
+      - patterns:
+          - pattern-either:
+              - pattern: '$REQ.query.state'
+              - pattern: '$REQ.body.state'
+              - pattern: '$URL.searchParams.get("state")'
+          - pattern-not-inside: |
+              if (<... $REQ.query.state ...>) { ... }
+          - pattern-not-inside: |
+              if (<... $REQ.body.state ...>) { ... }
+          - pattern-not-inside: |
+              if (<... $URL.searchParams.get("state") ...>) { ... }
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-007
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-no-state-validation
+      category: security
+      cwe: CWE-352
+      owasp: API1:2023
+      llm-prevalence: HIGH
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12

package/rules/oauth/no-state.yml

@@ -0,0 +1,41 @@
+rules:
+  - id: auth.oauth.no-state
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      OAuth 2.0 authorization request is being built WITHOUT a `state`
+      parameter. This opens you to CSRF attacks during the OAuth dance —
+      an attacker can trick the victim into logging in as the attacker.
+
+      Always generate a cryptographically random `state`, store it in a
+      session/cookie, and validate it on the callback. PKCE alone is not a
+      substitute for `state` when handling browser sessions.
+    pattern-either:
+      # Inline authorize URL carrying both client_id and response_type but no
+      # state. The path is not hardcoded (Google uses /o/oauth2/v2/auth, etc.).
+      - patterns:
+          - pattern-regex: |-
+              ['"]https?://[^'"\s]+\?[^'"]*client_id=[^'"]*['"]
+          - pattern-regex: |-
+              response_type=
+          - pattern-not-regex: |-
+              state=
+      # Programmatic URLSearchParams build (AST object match — robust to key
+      # order and length). Fires when client_id + response_type are present but
+      # state is not (covers both `state: x` and the `state` shorthand).
+      - patterns:
+          - pattern: 'new URLSearchParams({..., client_id: $C, ...})'
+          - pattern: 'new URLSearchParams({..., response_type: $R, ...})'
+          - pattern-not: 'new URLSearchParams({..., state: $S, ...})'
+          - pattern-not: 'new URLSearchParams({..., state, ...})'
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-no-state
+      category: security
+      cwe: CWE-352
+      owasp: API1:2023
+      llm-prevalence: HIGH
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12

package/rules/oauth/open-redirect-callback.yml

@@ -0,0 +1,47 @@
+rules:
+  - id: auth.oauth.open-redirect-callback
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      The OAuth callback handler redirects to a URL taken straight from
+      the request without validating it. An attacker can craft a phishing
+      link to your real callback that forwards the victim to a malicious
+      site under your domain's trust.
+
+      Maintain an explicit allow-list of post-login redirect destinations
+      (route names or full URLs you control). Never forward to an
+      arbitrary `req.query.redirect_to`, `req.query.next`, or
+      `req.query.return_url` value.
+    # Taint mode so indirection (const next = req.query.next; res.redirect(next))
+    # and defaults/casts are caught, not just the direct form. Validating the
+    # value against an allow-list (Set.has / Array.includes) clears the taint.
+    mode: taint
+    pattern-sources:
+      - pattern: '$REQ.query.$A'
+      - pattern: '$REQ.body.$A'
+      - pattern: '$REQ.params.$A'
+      - pattern: '$REQ.query[$K]'
+      - pattern: '$REQ.body[$K]'
+    pattern-sanitizers:
+      - pattern: '$SET.has(...)'
+      - pattern: '$ARR.includes(...)'
+      - pattern: '$ARR.indexOf(...)'
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: '$RES.redirect($SINK)'
+              - pattern: '$RES.redirect($CODE, $SINK)'
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-008
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-open-redirect-callback
+      category: security
+      cwe: CWE-601
+      owasp: API1:2023
+      llm-prevalence: HIGH
+      technology:
+        - express
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html

package/rules/oauth/wildcard-redirect.yml

@@ -0,0 +1,45 @@
+rules:
+  - id: auth.oauth.wildcard-redirect
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      OAuth `redirect_uri` allow-list contains a wildcard, an `http://` URL,
+      or `localhost`. Wildcards (and HTTP) let an attacker register their own
+      callback URL and harvest authorization codes; `localhost` whitelisting
+      is acceptable for dev tooling but disastrous in production.
+
+      Pin redirect URIs to exact, HTTPS URLs of subdomains you control. RFC 6749
+      §10.6 explicitly requires "exact match" or restricted matching.
+    pattern-either:
+      # Array allow-list containing a wildcard.
+      - patterns:
+          - pattern-regex: |-
+              redirect_uris?\s*[:=]\s*\[[^\]]*['"][^'"]*\*[^'"]*['"]
+      # Array allow-list containing an http:// URL (loopback dev URLs allowed).
+      - patterns:
+          - pattern-regex: |-
+              redirect_uris?\s*[:=]\s*\[[^\]]*['"]http://[^'"]*['"]
+          - pattern-not-regex: |-
+              http://(?:localhost|127\.0\.0\.1|\[::1\])
+      # Scalar redirect_uri with a wildcard.
+      - patterns:
+          - pattern-regex: |-
+              redirect_uri\s*[:=]\s*['"][^'"]*\*[^'"]*['"]
+      # Scalar redirect_uri with an http:// URL (loopback dev URLs allowed).
+      - patterns:
+          - pattern-regex: |-
+              redirect_uri\s*[:=]\s*['"]http://[^'"]*['"]
+          - pattern-not-regex: |-
+              http://(?:localhost|127\.0\.0\.1|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-wildcard-redirect
+      category: security
+      cwe: CWE-601
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.6
+        - https://datatracker.ietf.org/doc/html/rfc8252#section-7.3