VBC-937: client-side-auth-check

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .jsx, .tsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Tags: security ai-error

What it reports

Authentication token or role stored/read from browser storage at line {line}. Client-side auth logic is trivially bypassable. Validate identity server-side on every request. Never trust data in localStorage or sessionStorage for access control decisions.

Flagged

const role = localStorage.getItem('role');

Not flagged

const theme = localStorage.getItem('theme');

Pattern

(localStorage|sessionStorage)\.(getItem|setItem)\s*\(\s*['"](?:token|auth|role|user|admin|permission)['"]\s*\)