no-client-side-auth-logic

Prevent client-side authentication logic that can be bypassed. This rule is part of eslint-plugin-browser-security and provides LLM-optimized error messages.

Type-unaware

Prevent client-side authentication logic that can be bypassed. This rule is part of eslint-plugin-browser-security.

Quick Summary

Aspect	Details
Severity	Error (security)
Auto-Fix	❌ No auto-fix
Category	Browser Security
ESLint MCP	✅ Optimized for ESLint MCP integration

Rule Details

Client-side authentication checks can be easily bypassed. Always validate authentication on the server.

Examples

❌ Incorrect

if (localStorage.getItem('authenticated')) { proceed() }

✅ Correct

// Server validates and returns appropriate response
const response = await fetch('/api/admin/panel', {
  headers: { Authorization: `Bearer ${token}` },
});

if (response.ok) {
  showAdminPanel();
}

Configuration

{
  rules: {
    'browser-security/no-client-side-auth-logic': 'error'
  }
}

⚙️ Options

Option	Type	Default	Description
`authKeywords`	`string[]`	`["admin","authenticated","authorized","isAdmin","isAuthenticated","role"]`	Storage keys indicating a client-side authorization decision, matched whole-word against the key segments.
`credentialProperties`	`string[]`	`["password","secret","token"]`	Property names treated as credentials in an equality comparison.

Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.

Follow the benchmarks Star on GitHub