Client-side authentication is a design flaw where the browser or app performs the main authentication check instead of the server. The client may hide buttons, set a flag, or run JavaScript that decides whether a user is “logged in,” but those checks are not trustworthy because the attacker controls the client. If the server accepts the client’s claim without independently verifying identity and session state, the control can be bypassed by editing requests, replaying tokens, or calling the endpoint directly.
This matters because authentication must be enforced on the server for every protected action. In real attacks, weak client-side checks can expose admin functions, configuration changes, or sensitive data even when the interface looks locked down. Defenders should verify credentials and permissions server-side, bind actions to validated sessions, and treat all client input as untrusted. Secure systems use client-side code only for usability, never as the source of truth for access control.