rules:
  - id: auth.py.flask.session-cookie-insecure
    languages:
      - python
    severity: ERROR
    message: |
      A Flask cookie security flag is disabled through `app.config`, weakening
      session and remember-me cookie protection.

      `SESSION_COOKIE_SECURE = False` lets the session cookie travel over plain
      HTTP where it can be sniffed on the wire, and `SESSION_COOKIE_HTTPONLY =
      False` exposes it to JavaScript so an XSS payload can read and exfiltrate
      it; the `REMEMBER_COOKIE_*` flags do the same for Flask-Login's long-lived
      remember-me token (CWE-614, OWASP A05:2021). Keep these `True` (or drive
      them from an environment check), e.g. `app.config["SESSION_COOKIE_SECURE"]
      = True` and `app.config["SESSION_COOKIE_HTTPONLY"] = True`.
    # Matches ONLY the literal `False` set via `app.config[...] = False` (the
    # subscript form) or `app.config.update(...=False)` (the keyword form), the
    # `app.config` variants that the bare module-level assignment rule
    # `auth.py.cookie.insecure-flags` does NOT see. `= True` and env-driven
    # values are never flagged. `$APP` matches any Flask app variable name.
    pattern-either:
      - pattern: $APP.config['SESSION_COOKIE_SECURE'] = False
      - pattern: $APP.config['SESSION_COOKIE_HTTPONLY'] = False
      - pattern: $APP.config['REMEMBER_COOKIE_SECURE'] = False
      - pattern: $APP.config['REMEMBER_COOKIE_HTTPONLY'] = False
      - pattern: $APP.config.update(..., SESSION_COOKIE_SECURE=False, ...)
      - pattern: $APP.config.update(..., REMEMBER_COOKIE_SECURE=False, ...)
    metadata:
      oauthlint-rule-id: AUTH-PY-FLASK-001
      oauthlint-doc-url: https://oauthlint.dev/rules/py-flask-session-cookie-insecure
      category: security
      cwe: CWE-614
      owasp: A05:2021
      llm-prevalence: MEDIUM
      technology:
        - flask
        - flask-login
      references:
        - https://flask.palletsprojects.com/en/stable/config/#SESSION_COOKIE_SECURE
        - https://flask-login.readthedocs.io/en/latest/#cookie-settings
        - https://cwe.mitre.org/data/definitions/614.html