This matrix is the per-check source of truth for what SessionScope can find on a scanned project. To decide whether a check fires on your stack, find the check ID, then read across the Languages, Frameworks, Libraries/SDKs, and Triggering APIs columns. SessionScope is offline-only and evidence-bound: supported means deterministic source patterns are recognized, review-required means dynamic or framework-default behavior is surfaced for reviewer confirmation, and not covered means the stack or pattern is intentionally out of scope for this release round.
Narrative framework notes remain in FRAMEWORK_COVERAGE.md and provider/library notes remain in PROVIDER_LIBRARY_COVERAGE.md.
| Check ID | Languages | Frameworks | Libraries/SDKs | Triggering APIs / option keys | Lifecycle stage | Finding category | SARIF rule ID | What this means for your project |
|---|---|---|---|---|---|---|---|---|
cookie_missing_httponly |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | supported: res.cookie, cookies().set, NextResponse.cookies.set, Response.set_cookie, Django SESSION_COOKIE_HTTPONLY, static Set-Cookie |
store | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Session-like cookies without static HttpOnly evidence are flagged. |
cookie_default_false_httponly |
JS/TS, Python | Express, FastAPI, Django | Framework cookie defaults | review-required: framework-default HttpOnly false/omitted defaults | store | framework_default_assumed |
framework_default_assumed |
Review framework defaults instead of assuming a safe local setting. |
cookie_dynamic_httponly |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | review-required: variable/spread/splat cookie options | store | dynamic_review_required |
dynamic_review_required |
Runtime options determine HttpOnly behavior. |
cookie_default_httponly |
JS/TS, Python | Express, FastAPI, Django | Framework cookie defaults | review-required: framework-default HttpOnly evidence | store | framework_default_assumed |
framework_default_assumed |
Local source relies on framework defaults. |
cookie_missing_secure |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | supported: omitted or false Secure on literal cookie names | transmit | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Cookies lacking Secure evidence are flagged. |
cookie_default_false_secure |
JS/TS, Python | Express, FastAPI, Django | Framework cookie defaults | review-required: default Secure false | transmit | framework_default_assumed |
framework_default_assumed |
Review deployment defaults for HTTPS-only cookie transport. |
cookie_dynamic_secure |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | review-required: dynamic Secure option | transmit | dynamic_review_required |
dynamic_review_required |
Runtime settings determine whether the cookie is HTTPS-only. |
cookie_default_secure |
JS/TS, Python | Express, FastAPI, Django | Framework cookie defaults | review-required: default Secure evidence | transmit | framework_default_assumed |
framework_default_assumed |
Local source does not set Secure directly. |
cookie_samesite_none_without_secure |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | supported: SameSite=None with missing or false Secure |
transmit | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Cross-site cookies must also be Secure. |
cookie_samesite_none_dynamic_secure |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | review-required: SameSite=None with dynamic Secure |
transmit | dynamic_review_required |
dynamic_review_required |
Confirm Secure is enabled whenever SameSite=None is active. |
cookie_samesite_none_default_secure |
JS/TS, Python | Express, FastAPI, Django | Framework cookie defaults | review-required: SameSite=None with default Secure |
transmit | framework_default_assumed |
framework_default_assumed |
Confirm framework/deployment Secure behavior. |
cookie_samesite_none_cross_site_review |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | review-required: SameSite=None with Secure |
transmit | dynamic_review_required |
dynamic_review_required |
Confirm the cross-site cookie flow is intentional. |
cookie_missing_samesite |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | supported: session-like cookie without SameSite evidence | transmit | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Session-like cookies should set SameSite explicitly. |
cookie_dynamic_samesite |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | review-required: dynamic SameSite option | transmit | dynamic_review_required |
dynamic_review_required |
Runtime settings determine SameSite behavior. |
cookie_default_samesite |
JS/TS, Python | Express, FastAPI, Django | Framework cookie defaults | review-required: framework SameSite default | transmit | framework_default_assumed |
framework_default_assumed |
Local source relies on framework SameSite defaults. |
cookie_excessive_max_age |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | supported: static Max-Age over 30 days | expire | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Long-lived cookies are flagged for lifetime reduction. |
cookie_excessive_expires |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | supported: static relative Expires over 30 days | expire | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Long-lived Expires values are flagged. |
cookie_absolute_expires_review |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | review-required: far-future absolute Expires | expire | dynamic_review_required |
dynamic_review_required |
Review effective cookie lifetime. |
cookie_broad_domain_scope |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | supported: session-like broad Domain literals | transmit | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Session-like cookies scoped to broad domains are flagged. |
cookie_dynamic_domain_scope |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | review-required: dynamic Domain option | transmit | dynamic_review_required |
dynamic_review_required |
Runtime domain scope requires review. |
cookie_broad_path_scope |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | supported: session-like Path=/ |
transmit | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Broad path scope is flagged for session-like cookies. |
cookie_dynamic_path_scope |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | review-required: dynamic Path option | transmit | dynamic_review_required |
dynamic_review_required |
Runtime path scope requires review. |
cookie_dynamic_expiry |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | review-required: dynamic Max-Age or Expires | expire | dynamic_review_required |
dynamic_review_required |
Runtime lifetime requires review. |
cookie_missing_expiry |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic Python | Cookie APIs | supported: session-like/signed cookie with no explicit expiry | expire | lifecycle_gap |
lifecycle_gap |
Explicit lifetime evidence is missing. |
sliding_expiry_without_rotation_review |
JS/TS, Python | Express, generic JS/TS/Python session middleware or refresh helpers | Session middleware (session.middleware evidence), refresh expire/store evidence |
review-required: source-visible session-config or helper code whose evidence excerpt contains rolling/sliding/idle/touch/refreshSessionTtl/extend_session and maxage/ttl/expires/expiresat terms, without linked session.regenerate, cycle_key, session reissue, or refresh-token rotation evidence; not covered: Django SESSION_COOKIE_AGE in settings.py (this setting does not appear in session.middleware evidence) and other runtime-only framework settings outside scanned source |
expire/refresh | lifecycle_gap |
lifecycle_gap |
Sliding expiry should be paired with session or refresh-token rotation evidence. |
cookie_host_prefix_path_violation |
JS/TS, Python | Express, Next.js, FastAPI, Django runtime set_cookie, generic Python |
Cookie APIs and static Set-Cookie |
supported: literal __Host- name with Path missing or not /; review-required: dynamic Path |
transmit | high_confidence_misconfiguration or dynamic_review_required |
matching finding category | __Host- cookies must set Path=/. |
cookie_host_prefix_domain_violation |
JS/TS, Python | Express, Next.js, FastAPI, Django runtime set_cookie, generic Python |
Cookie APIs and static Set-Cookie |
supported: literal __Host- name with any Domain; review-required: dynamic Domain |
transmit | high_confidence_misconfiguration or dynamic_review_required |
matching finding category | __Host- cookies must omit Domain and remain host-only. |
cookie_host_prefix_secure_violation |
JS/TS, Python | Express, Next.js, FastAPI, Django runtime set_cookie, generic Python |
Cookie APIs and static Set-Cookie |
supported: literal __Host- name with missing/false Secure; review-required: dynamic/default Secure |
transmit | high_confidence_misconfiguration or dynamic_review_required |
matching finding category | __Host- cookies must be Secure. |
cookie_secure_prefix_secure_violation |
JS/TS, Python | Express, Next.js, FastAPI, Django runtime set_cookie, generic Python |
Cookie APIs and static Set-Cookie |
supported: literal __Secure- name with missing/false Secure; review-required: dynamic/default Secure |
transmit | high_confidence_misconfiguration or dynamic_review_required |
matching finding category | __Secure- cookies must be Secure. |
cookie_partitioned_review |
JS/TS, Python | Express, Next.js, FastAPI, generic Python; Django response.set_cookie(...) in views when the partitioned kwarg is source-visible |
Cookie APIs and static Set-Cookie |
review-required: source-visible partitioned=True kwarg in response.set_cookie(...) (Python), partitioned: true option in JS/TS cookie APIs, or Partitioned in a static Set-Cookie header string; not covered: Django settings.py or Django session engine configuration |
transmit | dynamic_review_required |
dynamic_review_required |
Partitioned/CHIPS usage depends on embed context SessionScope cannot prove. |
cookie_domain_leak_review |
JS/TS, Python | Express, Next.js, FastAPI, Django runtime set_cookie, generic Python |
Cookie APIs and static Set-Cookie |
review-required: broad Domain on non-session cookies | transmit | dynamic_review_required |
dynamic_review_required |
Broad non-session Domain scope needs host-boundary review. |
cookie_conflicting_writes_review |
JS/TS, Python | Express, Next.js, FastAPI, Django runtime set_cookie, generic Python |
Cookie APIs and static Set-Cookie |
review-required: same literal cookie name written multiple times in one handler scope | store | dynamic_review_required |
dynamic_review_required |
Last-write-wins behavior requires reviewer confirmation. |
jwt_decode_without_verify |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | jsonwebtoken, jose, PyJWT |
supported: decode/introspection without verification | introspect | high_confidence_misconfiguration |
high_confidence_misconfiguration |
JWT content is read without signature verification evidence. |
jwt_missing_issuer |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | jsonwebtoken, jose, PyJWT |
supported: verify without issuer evidence | validate | missing_validation_evidence |
missing_validation_evidence |
Issuer validation evidence is missing. |
jwt_missing_audience |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | jsonwebtoken, jose, PyJWT |
supported: verify without audience evidence | validate | missing_validation_evidence |
missing_validation_evidence |
Audience validation evidence is missing. |
jwt_missing_expiration |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | JWT issue APIs | supported: issued JWT without expiry evidence | expire | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Issued tokens should carry bounded expiry. |
jwt_dynamic_expiration |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | JWT issue APIs | review-required: dynamic expiry | expire | dynamic_review_required |
dynamic_review_required |
Runtime expiry configuration requires review. |
jwt_expiry_enforcement_disabled |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | JWT verify APIs | supported: ignore/disable expiry checks | validate | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Verification disables token expiry enforcement. |
jwt_dynamic_expiry_enforcement |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | JWT verify APIs | review-required: dynamic expiry enforcement | validate | dynamic_review_required |
dynamic_review_required |
Runtime verification options require review. |
jwt_default_expiry_enforcement |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | JWT verify APIs | review-required: library/default expiry enforcement | validate | framework_default_assumed |
framework_default_assumed |
Local source relies on library defaults. |
jwt_denylist_absent_on_logout_review |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic JS/TS/Python | JWT issue/validate APIs plus logout handlers | review-required: access-JWT lifecycle evidence linked by source context to logout evidence with no visible denylist, blocklist, revokeToken, or revocation-store insertion; not covered: runtime-only short-TTL policy or external gateway revocation |
revoke | lifecycle_gap |
lifecycle_gap |
Logout for stateless access JWTs needs reviewer confirmation when no denylist/revocation evidence is visible. |
jwt_alg_none_accepted |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | jsonwebtoken, PyJWT; jose explicit algorithm evidence |
supported: literal none in algorithms/algorithm; review-required: missing allow-list on default-sensitive library paths; not covered: python-jose/authlib JWT validation paths |
validate | high_confidence_misconfiguration or framework_default_assumed |
matching finding category | JWT validation should not accept unsigned tokens and should pin allowed algorithms. |
jwt_alg_confusion_signal |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | jsonwebtoken, jose, PyJWT |
supported: HMAC and asymmetric algorithms in one allow-list; review-required: HMAC algorithms paired with public-key-like key references; not covered: python-jose/authlib JWT validation paths | validate | high_confidence_misconfiguration or dynamic_review_required |
matching finding category | Accepted algorithms should match the expected key family. |
jwt_jku_header_trust |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | jsonwebtoken, jose, PyJWT |
review-required: complete verification context plus source-visible header.jku read; not covered: live URL allow-list verification or network JWKS state |
validate | dynamic_review_required |
dynamic_review_required |
Header-driven key URLs require reviewer confirmation and allow-listing. |
jwt_x5u_header_trust |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | jsonwebtoken, jose, PyJWT |
review-required: complete verification context plus source-visible header.x5u read; not covered: live URL allow-list verification or network certificate state |
validate | dynamic_review_required |
dynamic_review_required |
Header-driven certificate URLs require reviewer confirmation and allow-listing. |
jwt_embedded_jwk_trust |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | jsonwebtoken, jose, PyJWT |
review-required: complete verification context plus source-visible header.jwk read; not covered: live key trust verification |
validate | dynamic_review_required |
dynamic_review_required |
Embedded JWK header use requires reviewer confirmation. |
jwt_nbf_missing |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | jsonwebtoken, jose, PyJWT |
supported: validation path without source-visible nbf/not-before enforcement or with not-before checks disabled; not covered: issuer policy that intentionally never emits nbf |
validate | missing_validation_evidence |
missing_validation_evidence |
Not-before validation evidence is missing or disabled. |
jwt_clock_skew_review |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | jsonwebtoken, jose, PyJWT |
review-required: clock tolerance/leeway above 60 seconds or dynamic clock tolerance evidence | validate | dynamic_review_required |
dynamic_review_required |
Broad clock skew can extend token acceptance windows. |
jwt_kid_unvalidated_review |
JS/TS, Python | Next.js, FastAPI, Django, generic JS/TS/Python | jsonwebtoken, jose, PyJWT |
supported: source-visible kid header read without visible allow-list, pinned key map, or JWKS-style validation evidence; not covered: live JWKS/OIDC discovery state |
validate | missing_validation_evidence |
missing_validation_evidence |
Header key IDs should be constrained before key selection. |
oauth_pkce_missing_review |
JS/TS, Python | Next.js, Express, FastAPI/generic Python, generic JS/TS | passport-oauth2, openid-client, NextAuth/Auth.js, Authlib, generic OAuth/OIDC |
review-required: auth-code flow without source-visible code_challenge, code_challenge_method, code_verifier, or PKCE option; not covered: live provider defaults |
issue | dynamic_review_required |
dynamic_review_required |
Confirm PKCE is enforced by source or provider defaults. |
oauth_state_missing |
JS/TS, Python | Next.js, Express, FastAPI/generic Python, generic JS/TS | passport-oauth2, openid-client, NextAuth/Auth.js, Authlib, generic OAuth/OIDC |
supported: auth-code flow without source-visible state; review-required: provider-managed state defaults |
issue/validate | missing_validation_evidence |
missing_validation_evidence |
Auth-code flows should generate and validate state. |
oauth_state_static_review |
JS/TS, Python | Next.js, Express, FastAPI/generic Python, generic JS/TS | OAuth/OIDC client code | review-required: state assigned from a literal value; value redacted |
issue | dynamic_review_required |
dynamic_review_required |
Static state can undermine CSRF/correlation protections. |
oauth_state_unverified_review |
JS/TS, Python | Next.js, Express, FastAPI/generic Python, generic JS/TS | OAuth/OIDC callback handlers | supported: callback reads state with no visible comparison to session/cache/signed-cookie/helper state |
validate | missing_validation_evidence |
missing_validation_evidence |
Callback state should be compared before exchanging codes. |
oidc_nonce_missing |
JS/TS, Python | Next.js, Express, FastAPI/generic Python, generic JS/TS | OIDC flows via openid-client, NextAuth/Auth.js, Authlib, generic OIDC |
supported: openid-scoped flow without source-visible nonce; not covered: provider dashboard defaults |
issue | missing_validation_evidence |
missing_validation_evidence |
OIDC flows should bind ID tokens with a nonce. |
oidc_nonce_unverified_review |
JS/TS, Python | Next.js, Express, FastAPI/generic Python, generic JS/TS | OIDC ID-token verification code plus OAuth flow evidence | supported: nonce set without visible ID-token nonce verification option/comparison | validate | missing_validation_evidence |
missing_validation_evidence |
ID-token validation should verify the issued nonce. |
oauth_redirect_uri_wildcard_review |
JS/TS, Python | Next.js, Express, FastAPI/generic Python, generic JS/TS | OAuth/OIDC client registration/config literals | review-required: wildcard, bare-host, or top-level wildcard redirect URI literals; localhost loopback suppressed unless wildcarded | issue | dynamic_review_required |
dynamic_review_required |
Redirect URI matching should use exact callback URLs. |
token_in_local_storage |
JS/TS | Next.js browser/client paths, generic JS/TS | localStorage |
supported: localStorage.setItem with token-shaped key (access_token, id_token, refresh_token, jwt, bearer, auth, session); not covered: benign allowlisted keys |
store | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Browser-readable persistent token storage is flagged. |
token_in_session_storage |
JS/TS | Next.js browser/client paths, generic JS/TS | sessionStorage |
supported: sessionStorage.setItem with token-shaped key |
store | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Browser-readable tab/session token storage is flagged. |
token_in_url_path_or_fragment |
JS/TS | Next.js browser/client paths, generic JS/TS | URL builders / template strings | supported: token-shaped names with explicit values in URL path segments or fragments; query params remain covered separately; document.cookie token writes are retained as detector evidence only in P3 |
transmit | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Tokens should not be embedded in URL paths or fragments. |
client_secret_in_browser_code |
JS/TS | Next.js pages//app/, src/components/, public/, generic browser paths |
OAuth client config literals/identifiers | review-required: client_secret / clientSecret evidence in browser-shipped path heuristics |
store | dynamic_review_required |
dynamic_review_required |
OAuth client secrets must stay server-side. |
bearer_token_in_url_query |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic JS/TS/Python | Bearer/API-key handlers | supported: bearer/API-key token in query URL | transmit | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Tokens accepted from URLs can leak via logs/referrers. |
bearer_token_browser_storage |
JS/TS | Generic JS/TS, Next.js client-adjacent code | Browser APIs | supported: token-like values in browser storage | store | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Browser storage token use is flagged. |
bearer_static_secret_literal |
JS/TS, Python | Generic JS/TS/Python | Config/source literals | supported: obvious placeholder/static secret literal | store | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Static token-like literals are flagged. |
bearer_public_runtime_config_exposure |
JS/TS | Next.js/generic frontend config | Runtime config APIs | supported: public runtime config token exposure | store | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Public frontend config exposes token-like values. |
bearer_frontend_bundle_exposure |
JS/TS | Next.js/generic frontend code | Client bundle indicators | supported: token-like values in frontend bundle context | store | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Frontend-shipped token material is flagged. |
bearer_missing_validation |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic JS/TS/Python | Bearer/API-key handlers | supported: token use with no validation evidence | validate | missing_validation_evidence |
missing_validation_evidence |
Token validation evidence is missing. |
bearer_issue_without_expiry |
JS/TS, Python | Generic JS/TS/Python | Bearer/API-key issue helpers | supported: issued opaque token without expiry | expire | lifecycle_gap |
lifecycle_gap |
Token issue flow lacks expiry evidence. |
bearer_missing_rotation_or_revocation |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic JS/TS/Python | Bearer/API-key lifecycle helpers | supported: refresh/reuse lifecycle without revoke/rotate evidence | revoke | lifecycle_gap |
lifecycle_gap |
Token lifecycle lacks rotation or revocation evidence. |
refresh_family_revocation_absent_on_logout_review |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic JS/TS/Python | Refresh-token lifecycle helpers plus logout handlers | review-required: refresh-token lifecycle evidence linked by source context to logout evidence with no visible family/user-scoped refresh revocation such as revokeRefreshFamily, delete refresh_tokens where user_id, or refresh-family cache deletion; not covered: provider dashboard revocation outside source |
revoke | lifecycle_gap |
lifecycle_gap |
Logout should revoke the user's refresh-token family, not only clear a browser cookie. |
password_change_global_revocation_absent_review |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic JS/TS/Python | Password-change handlers plus session/refresh revocation helpers | review-required: password-change handler evidence without linked global session invalidation, refresh-family revocation, or token-version bump; not covered: standalone password validators or runtime-only identity-provider policy | revoke | lifecycle_gap |
lifecycle_gap |
Password changes should invalidate existing sessions and refresh families. |
bearer_missing_scope_evidence |
JS/TS, Python | Generic JS/TS/Python, provider fixtures | Provider/token-boundary APIs | supported: token lacks scope/boundary evidence | validate | missing_validation_evidence |
missing_validation_evidence |
Scope or boundary evidence is missing. |
bearer_dynamic_provider_review |
JS/TS, Python | Next.js, Express, generic JS/TS/Python | Auth0, Okta, Cognito, Azure AD, Firebase, Supabase, Clerk, Passport, NextAuth/AuthJS, OAuth/OIDC generic | review-required: provider-managed token behavior | refresh/revoke | dynamic_review_required |
dynamic_review_required |
Provider-managed lifecycle behavior needs human review. |
query_param_token_acceptance_review |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic JS/TS/Python | Request/query APIs | review-required: dynamic query token acceptance | transmit | dynamic_review_required |
dynamic_review_required |
Query token acceptance needs review. |
query_param_reset_or_verification_review |
JS/TS, Python | Generic JS/TS/Python | Reset/verification flows | review-required: reset or verification token in query | transmit | dynamic_review_required |
dynamic_review_required |
Reset/verification query-token handling needs review. |
query_param_auth_token_acceptance |
JS/TS, Python | Express, Next.js, FastAPI, Django, generic JS/TS/Python | Request/query APIs | supported: auth/access token accepted from query parameter | transmit | high_confidence_misconfiguration |
high_confidence_misconfiguration |
Auth tokens accepted from query strings are flagged. |
trust_boundary_inbound_outbound_reuse_review |
JS/TS, Python | Generic JS/TS/Python, provider fixtures | Provider/boundary config | review-required: same token context spans inbound/outbound trust boundaries | introspect | dynamic_review_required |
dynamic_review_required |
Review token reuse across trust boundaries. |
trust_boundary_frontend_backend_reuse_review |
JS/TS, Python | Next.js/generic frontend-backend code | Provider/boundary config | review-required: token reused in frontend and backend contexts | introspect | dynamic_review_required |
dynamic_review_required |
Review whether frontend and backend should share token material. |
trust_boundary_environment_reuse_review |
JS/TS, Python | Generic JS/TS/Python | Environment config | review-required: token reused across environments | introspect | dynamic_review_required |
dynamic_review_required |
Review cross-environment token reuse. |
trust_boundary_provider_scope_review |
JS/TS, Python | Provider fixtures | Auth0, Okta, Cognito, Azure AD, Firebase, Supabase, Clerk, Passport, NextAuth/AuthJS, OAuth/OIDC generic | review-required: provider/scope boundary needs review | introspect | dynamic_review_required |
dynamic_review_required |
Review provider-managed scope and boundary assumptions. |
trust_boundary_metadata_review |
JS/TS, Python | Generic JS/TS/Python | Boundary metadata | review-required: boundary metadata present but inconclusive | introspect | dynamic_review_required |
dynamic_review_required |
Review token boundary metadata for intended separation. |
session_fixation_login_regeneration_review |
JS/TS, Python | Express, Next.js, Django | Session APIs | review-required: login transition without clear regeneration evidence | issue/refresh | dynamic_review_required |
dynamic_review_required |
Confirm sessions are regenerated after login. |
session_fixation_privilege_regeneration_review |
JS/TS, Python | Express, Next.js, Django | Session APIs | review-required: privilege transition without clear regeneration evidence | issue/refresh | dynamic_review_required |
dynamic_review_required |
Confirm sessions are regenerated after privilege elevation. |
- Express: supported for source-visible
res.cookie,res.clearCookie, staticSet-Cookie,express-session,cookie-session, session regeneration/destruction, refresh helpers, Passport strategy context, and provider lifecycle calls. - Next.js: supported for App Router handlers,
cookies().set/delete,NextResponse.cookies.set/delete, supported JWT libraries, Auth.js/NextAuth source-visible provider callbacks, and source-visible refresh/logout calls. - FastAPI: supported for
Response.set_cookie/delete_cookie,Cookie,Depends,Security,OAuth2PasswordBearer,APIKeyCookie, supported JWT libraries, and source-visible refresh/logout helpers. - Django: supported for
SESSION_COOKIE_*,login,logout,cycle_key,delete_cookie, signing helpers, reset-token timeout evidence, and supported JWT libraries. - Generic JS/TS/Python: supported for recognized JWT, bearer/API-key, query-token, trust-boundary, refresh, reset, and provider/library patterns listed above.
The following are intentional gaps for the v0.2 edge-case-hardening round unless a later issue explicitly changes scope: Flask, Tornado, Sanic, Starlette, NestJS, Koa, Fastify, Hapi, Remix, Hono, SvelteKit, Go, Ruby/Rails, Java/Spring, .NET, PHP, python-jose (JWT validation), Authlib JWT validation (note: Authlib OAuth flow construction and authorization URL code IS covered via the generic-python path), live provider dashboard policy, live JWKS/OIDC discovery state, custom session-store internals, external dependency-injection containers, and runtime-only deployment configuration.