Client-side checks are security rules and validations that run inside an application on the user’s device. They may confirm a login state, inspect an input field, verify a certificate, or enforce anti-tamper logic before the app sends a request to the server. Because the code runs locally, the user and any malware on the device can potentially observe, bypass, or modify it.
In cyber security, this matters because client-side checks are useful for defense but are not a trusted final authority. Attackers who repackage or patch an app can rewrite these checks and make a modified binary behave as if it were legitimate. Defenders therefore avoid relying on app-only controls for high-value decisions. Stronger approaches include backend verification, request binding, platform attestation, and server-side fraud detection, which do not depend on code running in a potentially compromised app.