oauthlint-rules 0.4.0 → 0.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",

package/rules/cookie/long-lived.yml

@@ -6,8 +6,8 @@ rules:
     severity: INFO
     message: |
       An auth-looking cookie is being set with a `maxAge` greater than
-      30 days (the threshold is 30 × 24 × 60 × 60 × 1000 = 2_592_000_000
-      milliseconds). Long-lived session cookies expand the blast radius
+      30 days. The threshold is 30 × 24 × 60 × 60 × 1000 = 2_592_000_000
+      milliseconds. Long-lived session cookies expand the blast radius
       of any single token theft and bypass server-side revocation if
       the application doesn't validate freshness on every request.
 

package/rules/express/cookie-insecure.yml

@@ -0,0 +1,44 @@
+rules:
+  - id: auth.express.cookie-insecure
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      An Express session cookie is explicitly configured as insecure. Setting
+      `secure: false` lets the browser send the session cookie over plain HTTP,
+      and `httpOnly: false` exposes it to `document.cookie` (any XSS reads it).
+
+      Either drop the flag (the framework default may still need hardening) or
+      set `secure: true` and `httpOnly: true` for production. If you need
+      insecure cookies in dev, gate the value on `NODE_ENV !== 'production'`
+      rather than hard-coding `false`.
+    # Targets the session-middleware config object only, never `res.cookie(...)`
+    # (that shape is covered by the auth.cookie.* rules). We match ONLY an
+    # explicit `secure: false` / `httpOnly: false`; a MISSING key is left alone
+    # because express-session already defaults `secure` to false and dev setups
+    # legitimately omit it, so a missing key is undecidable prod-vs-dev and would
+    # be false-positive prone.
+    pattern-either:
+      # express-session: the flags live on a nested `cookie:` object.
+      - pattern: 'session({..., cookie: {..., secure: false, ...}, ...})'
+      - pattern: 'session({..., cookie: {..., httpOnly: false, ...}, ...})'
+      - pattern: 'expressSession({..., cookie: {..., secure: false, ...}, ...})'
+      - pattern: 'expressSession({..., cookie: {..., httpOnly: false, ...}, ...})'
+      # cookie-session: the flags live directly on the options object.
+      - pattern: 'cookieSession({..., secure: false, ...})'
+      - pattern: 'cookieSession({..., httpOnly: false, ...})'
+    metadata:
+      oauthlint-rule-id: AUTH-EXPRESS-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/express-cookie-insecure
+      category: security
+      cwe: CWE-614
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - express-session
+        - cookie-session
+      references:
+        - https://github.com/expressjs/session#cookiesecure
+        - https://github.com/expressjs/cookie-session#options
+        - https://cwe.mitre.org/data/definitions/614.html

package/rules/flow/insecure-random.yml

@@ -5,11 +5,11 @@ rules:
       - typescript
     severity: ERROR
     message: |
-      `Math.random()` is being assigned to (or used to compute) a value
-      whose name indicates it is security-sensitive — a token, a CSRF
-      value, an OAuth `state`, a session id, a nonce, or a verification
-      code. `Math.random()` is NOT cryptographically secure and is
-      predictable enough for an attacker with enough samples to recover
+      `Math.random()` produces a value whose name marks it as
+      security-sensitive. The value is assigned to (or computed for) a token,
+      a CSRF value, an OAuth `state`, a session id, a nonce, or a
+      verification code. `Math.random()` is NOT cryptographically secure and
+      is predictable enough for an attacker with enough samples to recover
       the seed.
 
       Use `crypto.randomBytes(N)` (Node) or `crypto.getRandomValues()`

package/rules/flow/oauth-credential-in-log.yml

@@ -5,14 +5,15 @@ rules:
       - typescript
     severity: ERROR
     message: |
-      An OAuth/OIDC credential taken from the request — an authorization
-      `code`, an `access_token` / `refresh_token` / `id_token`, a bearer
-      `token`, a `client_secret`, or the raw `Authorization` header — flows
-      into a logging call (`console.*` or `logger.*`). Logs are written to
-      files, shipped to aggregators (Datadog, Splunk, CloudWatch) and read by
-      people and systems that should never see live credentials. A leaked
-      authorization code or token can be replayed to impersonate the user or
-      complete the OAuth exchange (CWE-532).
+      An OAuth/OIDC credential from the request flows into a logging call.
+      The tainted value is an authorization `code`, an `access_token` /
+      `refresh_token` / `id_token`, a bearer `token`, a `client_secret`, or
+      the raw `Authorization` header, and the sink is a `console.*` or
+      `logger.*` call. Logs are written to files, shipped to aggregators
+      (Datadog, Splunk, CloudWatch) and read by people and systems that should
+      never see live credentials. A leaked authorization code or token can be
+      replayed to impersonate the user or complete the OAuth exchange
+      (CWE-532).
 
       Never log the raw credential. Redact or mask it before logging
       (`token.slice(0, 4) + '…'`), log a non-sensitive identifier instead

package/rules/flow/secret-in-log.yml

@@ -5,12 +5,13 @@ rules:
       - typescript
     severity: WARNING
     message: |
-      A secret-shaped value (`password`, `token`, `secret`, `apiKey`,
-      `accessToken`, `refreshToken`, `privateKey`, `clientSecret`, …) is
-      being passed to a logging call (`console.*` or `logger.*`). Logs are
-      routinely written to files, shipped to aggregators (Datadog, Splunk,
-      CloudWatch) and read by people who should never see the raw secret —
-      this is a textbook credential leak.
+      A secret-shaped value is passed to a logging call. The logged
+      identifier is named like a credential (`password`, `token`, `secret`,
+      `apiKey`, `accessToken`, `refreshToken`, `privateKey`, `clientSecret`,
+      …) and the sink is a `console.*` or `logger.*` call. Logs are routinely
+      written to files, shipped to aggregators (Datadog, Splunk, CloudWatch)
+      and read by people who should never see the raw secret. This is a
+      textbook credential leak.
 
       Never log secrets. Redact or mask them before logging
       (`token.slice(0, 4) + '…'`), log a non-sensitive identifier instead

package/rules/go/flow/oauth-credential-in-log.yml

@@ -4,14 +4,15 @@ rules:
       - go
     severity: ERROR
     message: |
-      An OAuth/OIDC credential taken from the HTTP request — an authorization
-      `code`, an `access_token` / `refresh_token` / `id_token`, a bearer
-      `token`, a `client_secret`, or the raw `Authorization` header — flows
-      into a logging call (`log.*`, `slog.*`, `fmt.Print*`, or a `logger.*`
-      method). Logs are written to files, shipped to aggregators (Datadog,
-      Splunk, CloudWatch) and read by people and systems that should never see
-      live credentials. A leaked authorization code or token can be replayed
-      to impersonate the user or complete the OAuth exchange (CWE-532).
+      An OAuth/OIDC credential from the HTTP request flows into a logging call.
+      The tainted value is an authorization `code`, an `access_token` /
+      `refresh_token` / `id_token`, a bearer `token`, a `client_secret`, or
+      the raw `Authorization` header, and the sink is a `log.*`, `slog.*`,
+      `fmt.Print*`, or `logger.*` call. Logs are written to files, shipped to
+      aggregators (Datadog, Splunk, CloudWatch) and read by people and systems
+      that should never see live credentials. A leaked authorization code or
+      token can be replayed to impersonate the user or complete the OAuth
+      exchange (CWE-532).
 
       Never log the raw credential. Redact or mask it before logging, log a
       non-sensitive identifier instead (a user id, a key id), or drop the

package/rules/go/flow/weak-rand.yml

@@ -4,9 +4,9 @@ rules:
       - go
     severity: ERROR
     message: |
-      A security-sensitive value — its name indicates a token, secret, key,
-      password, nonce, OTP, or salt — is being generated with the `math/rand`
-      package. `math/rand` is a deterministic PRNG: its output is predictable
+      A security-sensitive value is being generated with the `math/rand`
+      package. Its name indicates a token, secret, key, password, nonce, OTP,
+      or salt. `math/rand` is a deterministic PRNG: its output is predictable
       and an attacker who observes enough values can recover the seed and
       forecast every future token. For OAuth/OIDC this means forgeable
       `state` values, guessable authorization codes, and predictable refresh

package/rules/go/jwt/skip-claims-validation.yml

@@ -4,12 +4,12 @@ rules:
       - go
     severity: WARNING
     message: |
-      A JWT parser is configured with `jwt.WithoutClaimsValidation()`, which
-      turns OFF the standard registered-claims validation golang-jwt performs by
-      default — the `exp` (expiry), `nbf` (not-before) and `iat` (issued-at)
-      checks. With validation disabled an expired or not-yet-valid token still
-      parses successfully, so a stolen or long-expired token is accepted as if
-      it were current (CWE-613).
+      A JWT parser turns off registered-claims validation with
+      `jwt.WithoutClaimsValidation()`. That option disables the `exp`
+      (expiry), `nbf` (not-before) and `iat` (issued-at) checks golang-jwt
+      performs by default. With validation disabled an expired or
+      not-yet-valid token still parses successfully, so a stolen or
+      long-expired token is accepted as if it were current (CWE-613).
 
       Remove `jwt.WithoutClaimsValidation()` and let golang-jwt validate the
       time-based claims. If a specific claim must be relaxed, scope it narrowly

package/rules/go/jwt/unchecked-method.yml

@@ -4,12 +4,12 @@ rules:
       - go
     severity: ERROR
     message: |
-      A `Keyfunc` passed to `jwt.Parse`/`jwt.ParseWithClaims` returns the
-      verification key WITHOUT first checking `token.Method` (the signing
-      algorithm). This enables an algorithm-confusion attack: if the server
-      verifies RS256 tokens with an RSA public key, an attacker can forge a
-      token signed with HS256 using that public key as the HMAC secret, and the
-      library will accept it — a complete authentication bypass (CWE-347).
+      A JWT `Keyfunc` returns the verification key without checking `token.Method`, enabling algorithm confusion.
+      It is passed to `jwt.Parse`/`jwt.ParseWithClaims` and hands back the key
+      without first asserting the signing algorithm. If the server verifies
+      RS256 tokens with an RSA public key, an attacker can forge an HS256 token
+      using that public key as the HMAC secret, and the library will accept it:
+      a complete authentication bypass (CWE-347).
 
       Always assert the signing method inside the keyfunc before returning the
       key, e.g.:

package/rules/go/tls/insecure-skip-verify.yml

@@ -4,12 +4,12 @@ rules:
       - go
     severity: ERROR
     message: |
-      A `tls.Config` is created with `InsecureSkipVerify: true`, which disables
-      verification of the server's certificate chain and host name. Any
-      attacker who can intercept the connection can present any certificate
-      and read or tamper with the traffic — a classic man-in-the-middle hole.
-      For OAuth/OIDC this leaks authorization codes, access tokens, and client
-      secrets in transit.
+      A `tls.Config` sets `InsecureSkipVerify: true`, disabling TLS certificate verification.
+      This turns off verification of the server's certificate chain and host
+      name, so any attacker who can intercept the connection can present any
+      certificate and read or tamper with the traffic: a classic
+      man-in-the-middle hole. For OAuth/OIDC this leaks authorization codes,
+      access tokens, and client secrets in transit.
 
       Never set `InsecureSkipVerify: true`. Leave verification on (the default).
       To trust a private CA in development, set `RootCAs` to a `*x509.CertPool`

package/rules/java/crypto/noop-password-encoder.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.java.crypto.noop-password-encoder
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      Spring stores passwords with no hashing.
+
+      `NoOpPasswordEncoder` keeps passwords in plaintext and
+      `withDefaultPasswordEncoder()` is a builder helper that Spring explicitly
+      marks for non-production use only. Either way the stored credential is not
+      hashed, so anyone who reads the database or a backup recovers every
+      password directly (CWE-256). This is a common AI-generated shortcut: the
+      no-op encoder is pasted in to "get login working" and never replaced.
+
+      Hash passwords with a dedicated, slow, salted algorithm. Use
+      `new BCryptPasswordEncoder()`, `Argon2PasswordEncoder`, or
+      `Pbkdf2PasswordEncoder` instead. A `DelegatingPasswordEncoder` built via
+      `PasswordEncoderFactories.createDelegatingPasswordEncoder()` is the
+      recommended default.
+    # Two literal sinks: the singleton no-op encoder and the deprecated
+    # User.withDefaultPasswordEncoder() builder helper. Both are tight enough
+    # that a match is always a real plaintext-password configuration.
+    pattern-either:
+      - pattern: NoOpPasswordEncoder.getInstance()
+      - pattern: $U.withDefaultPasswordEncoder()
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-CRYPTO-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-crypto-noop-password-encoder
+      category: security
+      cwe: CWE-256
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - spring-security
+      references:
+        - https://docs.spring.io/spring-security/reference/features/authentication/password-storage.html
+        - https://cwe.mitre.org/data/definitions/256.html

package/rules/java/web/security-ignoring-all.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.java.web.security-ignoring-all
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      Spring excludes all paths from the security filter chain.
+
+      `WebSecurity.ignoring()` removes the matched paths from the Spring
+      Security filter chain entirely, so they get no authentication,
+      authorization, CSRF, or header protection at all. Passing the `/**`
+      wildcard excludes every request, leaving the whole application unprotected
+      (CWE-862). This is a common AI-generated shortcut to silence security
+      errors during development that then ships to production.
+
+      Never `ignoring()` a broad wildcard. Limit it to genuinely static,
+      non-sensitive assets, e.g.
+      `web.ignoring().requestMatchers("/css/**", "/js/**")`, or better, handle
+      authorization inside the filter chain with `permitAll()` on scoped paths
+      so the security headers still apply.
+    # Literal `/**` passed to ignoring() across the Security 6 (requestMatchers)
+    # and legacy (antMatchers) APIs. A scoped asset path like "/css/**" does not
+    # match the literal "/**", so static-resource excludes do not fire.
+    pattern-either:
+      - pattern: $WEB.ignoring().requestMatchers("/**")
+      - pattern: $WEB.ignoring().antMatchers("/**")
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-WEB-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-web-security-ignoring-all
+      category: security
+      cwe: CWE-862
+      owasp: A01:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - spring-security
+      references:
+        - https://docs.spring.io/spring-security/reference/servlet/configuration/java.html
+        - https://cwe.mitre.org/data/definitions/862.html

package/rules/java/web/wildcard-permit-all.yml

@@ -0,0 +1,37 @@
+rules:
+  - id: auth.java.web.wildcard-permit-all
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      Spring permits every request via a catch-all matcher.
+
+      The `/**` matcher matches every path, so granting it `permitAll()` makes
+      the whole application reachable without authentication, including
+      state-changing and sensitive endpoints (CWE-862, broken access control).
+      This is a common AI-generated Spring mistake: a wide-open matcher is
+      pasted in to "make it work" and the intended access rules are never added.
+
+      Open only the specific public routes explicitly, e.g.
+      `requestMatchers("/public/**").permitAll()`, and require authentication by
+      default with `anyRequest().authenticated()`. Granting `permitAll()` on a
+      scoped path is fine; granting it on `/**` is not.
+    # Literal `/**` wildcard granted permitAll across the three matcher APIs
+    # (requestMatchers in Security 6, antMatchers/mvcMatchers in the legacy
+    # chain). Scoped paths like "/public/**" do not match the literal "/**".
+    pattern-either:
+      - pattern: $X.requestMatchers("/**").permitAll()
+      - pattern: $X.antMatchers("/**").permitAll()
+      - pattern: $X.mvcMatchers("/**").permitAll()
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-WEB-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-web-wildcard-permit-all
+      category: security
+      cwe: CWE-862
+      owasp: A01:2021
+      llm-prevalence: HIGH
+      technology:
+        - spring-security
+      references:
+        - https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html
+        - https://cwe.mitre.org/data/definitions/862.html

package/rules/jwt/ignore-expiration.yml

@@ -5,10 +5,10 @@ rules:
       - typescript
     severity: WARNING
     message: |
-      `jwt.verify(token, key, { ignoreExpiration: true })` from `jsonwebtoken`
-      disables the `exp` (expiry) claim check, so an expired token is accepted
-      as valid forever. A stolen or long-old token then never stops working,
-      defeating the whole point of short-lived access tokens.
+      `ignoreExpiration: true` in a `jsonwebtoken` `verify()` call disables the
+      `exp` claim check. An expired token is then accepted as valid forever, so
+      a stolen or long-old token never stops working, defeating the whole point
+      of short-lived access tokens.
 
       Remove `ignoreExpiration: true` so the `exp` claim is enforced, and set a
       sane `expiresIn` when signing (`jwt.sign(payload, key, { expiresIn: '15m'

package/rules/nextauth/hardcoded-secret.yml

@@ -0,0 +1,62 @@
+rules:
+  - id: auth.nextauth.hardcoded-secret
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      The NextAuth/Auth.js `secret` is set to a hard-coded string literal.
+
+      This value signs and encrypts every session JWT and CSRF token. Committed
+      to git it is one search away from compromise, letting an attacker forge
+      sessions for any user. Read it from the environment instead:
+      `secret: process.env.AUTH_SECRET` (or `NEXTAUTH_SECRET`) and add the
+      variable to `.env.example` with a placeholder.
+    # Anchored to a NextAuth/Auth.js config so a bare `secret:` in unrelated
+    # code never fires: the property must sit inside a `NextAuth(...)` /
+    # `Auth(...)` call, an `authOptions`/`authConfig` object, or an object typed
+    # as `NextAuthOptions` / `NextAuthConfig` / `AuthOptions`. The value is an
+    # AST string literal (`"..."`), so `process.env.*` reads are structurally
+    # excluded; the regex allow-list drops `${ENV}` templates, `<placeholders>`,
+    # and obvious doc/test stubs. `paths.exclude` keeps the rule off test and
+    # example trees (where dev secrets like `"secret"` are intentional), while
+    # still firing on its own fixtures under rules/tests/fixtures/.
+    patterns:
+      - pattern: 'secret: "..."'
+      - pattern-not-regex: |-
+          (?i)secret\s*:\s*['"]\$\{?[A-Za-z_]+\}?['"]
+      - pattern-not-regex: |-
+          (?i)secret\s*:\s*['"]<[^'"]*>['"]
+      - pattern-not-regex: |-
+          (?i)secret\s*:\s*['"](?:your[-_]|my[-_]|example|placeholder|xxx+|todo|fixme|test|dummy|fake|sample|changeme|change[-_]?me|redacted|replace)
+      - pattern-either:
+          - pattern-inside: 'NextAuth({...})'
+          - pattern-inside: 'NextAuth($A, {...})'
+          - pattern-inside: 'NextAuth($A, $B, {...})'
+          - pattern-inside: 'Auth($A, {...})'
+          - pattern-inside: 'authOptions = {...}'
+          - pattern-inside: 'authConfig = {...}'
+          - pattern-inside: '$X: NextAuthOptions = {...}'
+          - pattern-inside: '$X: NextAuthConfig = {...}'
+          - pattern-inside: '$X: AuthOptions = {...}'
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/__tests__/**"
+        - "**/*.test.*"
+        - "**/*.spec.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/demo/**"
+    metadata:
+      oauthlint-rule-id: AUTH-NEXTAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/nextauth-hardcoded-secret
+      category: security
+      cwe: CWE-798
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      technology:
+        - next-auth
+      references:
+        - https://authjs.dev/getting-started/deployment#auth_secret
+        - https://cwe.mitre.org/data/definitions/798.html

package/rules/oauth/implicit-flow.yml

@@ -5,9 +5,9 @@ rules:
       - typescript
     severity: ERROR
     message: |
-      OAuth implicit flow (`response_type=token` or `response_type=id_token
-      token`) is deprecated by OAuth 2.0 Security BCP (RFC 9700) and the
-      OAuth 2.1 working draft. The access token leaks into the URL
+      OAuth implicit flow is deprecated by the OAuth 2.0 Security BCP (RFC 9700)
+      and the OAuth 2.1 draft. It is triggered by `response_type=token` or
+      `response_type=id_token token`. The access token leaks into the URL
       fragment, browser history, and referrer headers, and there is no
       refresh-token mechanism.
 

package/rules/oauth/long-token-lifetime.yml

@@ -5,9 +5,9 @@ rules:
       - typescript
     severity: WARNING
     message: |
-      An OAuth `expires_in` (or comparable token-lifetime field) is being
-      set to a literal value greater than 86_400 seconds — i.e. longer
-      than 24 hours. Long-lived access tokens make every token theft
+      An OAuth token-lifetime field is set to a literal value longer than
+      24 hours. The value of `expires_in` (or a comparable field) exceeds
+      86_400 seconds. Long-lived access tokens make every token theft
       catastrophic because they remain valid for days or weeks; the
       industry standard is 15-60 minutes for access tokens, paired with
       a refresh-token rotation flow for longer sessions.

package/rules/oauth/no-pkce.yml

@@ -5,10 +5,10 @@ rules:
       - typescript
     severity: WARNING
     message: |
-      OAuth 2.0 authorization request looks like a public client (SPA,
-      mobile, or native app) but does not include a `code_challenge`
-      parameter. Without PKCE, the authorization code can be intercepted
-      and exchanged by an attacker.
+      OAuth authorization request from a public client omits the PKCE `code_challenge` parameter.
+      The request looks like a public client (SPA, mobile, or native app) yet
+      carries no `code_challenge`. Without PKCE, the authorization code can be
+      intercepted and exchanged by an attacker.
 
       RFC 8252 §6 mandates PKCE for native/SPA clients. RFC 9700 (OAuth 2.0
       Security BCP) recommends PKCE for ALL clients, including confidential

package/rules/oauth/token-in-localstorage.yml

@@ -5,17 +5,16 @@ rules:
       - typescript
     severity: WARNING
     message: |
-      An OAuth/OIDC token is being written to `localStorage` /
-      `sessionStorage` under a token-named key (`access_token`,
-      `refresh_token`, `id_token`, …). Web storage is readable by any
-      script on the origin, so any XSS — including a compromised
-      third-party dependency — can exfiltrate the token via
-      `getItem(...)`. There is no browser-side mitigation, unlike
+      An OAuth/OIDC token is written to `localStorage` / `sessionStorage`, readable by any script on the origin.
+      The key is token-named (`access_token`, `refresh_token`, `id_token`, …),
+      and web storage is exposed to every script on the page, so any XSS,
+      including a compromised third-party dependency, can exfiltrate the token
+      via `getItem(...)`. There is no browser-side mitigation, unlike
       `HttpOnly` cookies.
 
       Keep access/refresh/id tokens in memory only, or have the server
       issue them in a `Secure; HttpOnly; SameSite=Strict` cookie.
-      `sessionStorage` is no safer than `localStorage` against XSS — it
+      `sessionStorage` is no safer than `localStorage` against XSS: it
       grants the same attacker capability.
 
       See CWE-922: Insecure Storage of Sensitive Information.

package/rules/passport/jwt-ignore-expiration.yml

@@ -0,0 +1,58 @@
+rules:
+  - id: auth.passport.jwt-ignore-expiration
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      A `passport-jwt` strategy is configured with `ignoreExpiration: true`.
+
+      This disables the `exp` claim check, so the strategy authenticates expired
+      tokens forever. A leaked or long-old JWT then never stops working,
+      defeating short-lived access tokens. Remove `ignoreExpiration: true` (the
+      default is `false`, which enforces `exp`) and issue tokens with a short
+      lifetime. See CWE-613 (Insufficient Session Expiration).
+    # Scoped to `passport-jwt` so an unrelated `ignoreExpiration: true` (in some
+    # other library's options) never fires. The file must import the
+    # `passport-jwt` Strategy (named, aliased, default, or via `require`), and
+    # the option must sit inside a `new ...Strategy({...}, ...)` construction.
+    # `new $S({...}, ...)` matches passport-jwt's `(opts, verify)` constructor
+    # for any binding name, so the common `new JwtStrategy({ ... }, verify)`
+    # alias spelling is covered without relying on Semgrep alias resolution. The
+    # match is narrowed to the `ignoreExpiration: true` property itself, so it
+    # is caught regardless of which sibling options appear. Non-overlapping with
+    # auth.jwt.ignore-expiration, which is scoped to `jsonwebtoken`'s
+    # `jwt.verify(...)`.
+    patterns:
+      - pattern-either:
+          - pattern-inside: |
+              import { ..., Strategy, ... } from 'passport-jwt'
+              ...
+          - pattern-inside: |
+              import Strategy from 'passport-jwt'
+              ...
+          - pattern-inside: |
+              $S = require('passport-jwt')
+              ...
+          - pattern-inside: |
+              $S = require('passport-jwt').Strategy
+              ...
+          - pattern-inside: |
+              { ..., Strategy, ... } = require('passport-jwt')
+              ...
+      - pattern-either:
+          - pattern-inside: 'new $S({...}, ...)'
+          - pattern-inside: 'new $S.Strategy({...}, ...)'
+      - pattern: 'ignoreExpiration: true'
+    metadata:
+      oauthlint-rule-id: AUTH-PASSPORT-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/passport-jwt-ignore-expiration
+      category: security
+      cwe: CWE-613
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - passport-jwt
+      references:
+        - https://www.passportjs.org/packages/passport-jwt/
+        - https://cwe.mitre.org/data/definitions/613.html

package/rules/py/cors/allow-all.yml

@@ -4,14 +4,15 @@ rules:
       - python
     severity: ERROR
     message: |
-      Flask-CORS is configured with `supports_credentials=True` together with a
-      wildcard origin (`origins="*"`, `origins=["*"]`, or — since Flask-CORS
-      defaults to `*` — no `origins` argument at all). The CORS spec forbids the
+      Flask-CORS allows any origin while credentials are enabled.
+      This configuration pairs `supports_credentials=True` with a wildcard
+      origin (`origins="*"`, `origins=["*"]`, or no `origins` argument at all,
+      since Flask-CORS defaults to `*`). The CORS spec forbids the
       `Access-Control-Allow-Origin: *` + `Access-Control-Allow-Credentials: true`
-      combination, so browsers will block it; the dangerous "fix" is to leave the
-      wildcard in place while keeping credentials on, which exposes credentialed
-      cross-origin access to ANY website (CWE-942). For OAuth/OIDC this leaks
-      cookies, session tokens and CSRF protections cross-origin.
+      combination, so browsers will block it; the dangerous "fix" is to leave
+      the wildcard in place while keeping credentials on, which exposes
+      credentialed cross-origin access to ANY website (CWE-942). For OAuth/OIDC
+      this leaks cookies, session tokens and CSRF protections cross-origin.
 
       Credentialed requests must use an explicit allow-list of trusted origins,
       e.g. `CORS(app, origins=["https://app.example.com"], supports_credentials=True)`.

package/rules/py/cors/fastapi-wildcard-credentials.yml

@@ -0,0 +1,49 @@
+rules:
+  - id: auth.py.cors.fastapi-wildcard-credentials
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      FastAPI CORS allows any origin with credentials.
+
+      Starlette's `CORSMiddleware` is configured with a wildcard origin
+      (`allow_origins=["*"]` or `allow_origin_regex=".*"`) together with
+      `allow_credentials=True`. The CORS spec forbids
+      `Access-Control-Allow-Origin: *` alongside
+      `Access-Control-Allow-Credentials: true`, so Starlette silently reflects
+      the caller's `Origin` instead, turning the wildcard into "allow every
+      site" for credentialed requests. Any website can then read authenticated
+      responses, leaking cookies, session and OAuth tokens cross-origin
+      (CWE-942).
+
+      Credentialed CORS needs an explicit allow-list of trusted origins, e.g.
+      `allow_origins=["https://app.example.com"], allow_credentials=True`. If
+      the endpoint is genuinely public, drop credentials:
+      `allow_origins=["*"], allow_credentials=False`.
+    # Require the co-occurrence of a wildcard origin AND credentials on the SAME
+    # CORSMiddleware configuration. The first arm scopes to the `CORSMiddleware`
+    # symbol (either `app.add_middleware(CORSMiddleware, ...)` or a direct
+    # `CORSMiddleware(...)`); the AND-ed arms then demand both
+    # `allow_credentials=True` and a wildcard origin, so argument order does not
+    # matter and an explicit allow-list (or credentials disabled) never fires.
+    patterns:
+      - pattern-either:
+          - pattern: $APP.add_middleware(CORSMiddleware, ...)
+          - pattern: CORSMiddleware(...)
+      - pattern: $F(..., allow_credentials=True, ...)
+      - pattern-either:
+          - pattern: $F(..., allow_origins=["*"], ...)
+          - pattern: $F(..., allow_origin_regex=".*", ...)
+    metadata:
+      oauthlint-rule-id: AUTH-PY-CORS-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-cors-fastapi-wildcard-credentials
+      category: security
+      cwe: CWE-942
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      technology:
+        - fastapi
+      references:
+        - https://www.starlette.io/middleware/#corsmiddleware
+        - https://fastapi.tiangolo.com/tutorial/cors/
+        - https://cwe.mitre.org/data/definitions/942.html