Client-Side Only Auth Check

Why it matters

Client-side auth checks can be trivially bypassed. An attacker can set localStorage.setItem('token', 'fake') in the browser console and gain full access. All authentication must be verified server-side.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

const token = localStorage.getItem('token');
if (!token) {
  window.location.href = '/login';
}

The smallest fix

// Add server-side verification:
// Client sends token in header, server verifies it
const response = await fetch('/api/protected', {
  headers: { Authorization: `Bearer ${token}` }
});
// Server: verify token before responding

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Clear localStorage and verify the app redirects to login
2. Set a fake token in localStorage and verify server rejects it
3. Verify all protected API routes require server-side auth

Further reading

• https://cwe.mitre.org/data/definitions/602.html