@sun-asterisk/sunlint/rules/security/S039_no_session_tokens_in_url/config.json

☀️ SunLint - Multi-language static analysis tool for code quality and security | Sun* Engineering Standards

{
  "id": "S039",
  "name": "Do not pass Session Tokens via URL parameters",
  "category": "security",
  "description": "S039 - Detects when session tokens, authentication tokens, JWT tokens, or other sensitive authentication data are passed as URL parameters instead of secure headers or request body. URL parameters are logged in web server logs, browser history, and can be exposed in referrer headers.",
  "severity": "warning",
  "enabled": true,
  "semantic": {
    "enabled": true,
    "priority": "high",
    "fallback": "heuristic"
  },
  "patterns": {
    "include": ["**/*.js", "**/*.ts", "**/*.jsx", "**/*.tsx"],
    "exclude": [
      "**/*.test.js",
      "**/*.test.ts",
      "**/*.spec.js",
      "**/*.spec.ts",
      "**/node_modules/**",
      "**/dist/**",
      "**/build/**"
    ]
  },
  "analysis": {
    "approach": "symbol-based-primary",
    "fallback": "regex-based",
    "depth": 1,
    "timeout": 4000
  },
  "validation": {
    "sessionTokenParams": [
      "sessionId",
      "session_id",
      "session-id",
      "sessionToken",
      "session_token",
      "session-token",
      "authToken",
      "auth_token",
      "auth-token",
      "authorization",
      "bearer",
      "jwt",
      "jwtToken",
      "jwt_token",
      "jwt-token",
      "accessToken",
      "access_token",
      "access-token",
      "refreshToken",
      "refresh_token",
      "refresh-token",
      "apiKey",
      "api_key",
      "api-key",
      "csrfToken",
      "csrf_token",
      "csrf-token",
      "xsrfToken",
      "xsrf_token",
      "xsrf-token",
      "token",
      "apiToken",
      "api_token",
      "api-token",
      "sid",
      "sessionkey",
      "session_key",
      "session-key",
      "userToken",
      "user_token",
      "user-token",
      "authKey",
      "auth_key",
      "auth-key",
      "securityToken",
      "security_token",
      "security-token"
    ],
    "urlAccessPatterns": [
      "req.query",
      "req.params",
      "searchParams.get",
      "@Query",
      "@Param",
      "URLSearchParams",
      "location.search"
    ],
    "frameworks": ["express", "nestjs", "nextjs", "nuxtjs"]
  }
}