CWE-602 Client-Side Enforcement of Server-Side Security
What this means
SiteShadow flagged a pattern where a security control appears to be enforced only in the client (UI), but not enforced on the server (API). Attackers can bypass the UI and call the server directly.
Why it matters
Client-side controls can be bypassed by attackers.
- Authorization bypass: hidden buttons don't stop API calls.
- Business logic abuse: client-side validation can be skipped or modified.
- Privilege escalation if the server trusts client-side flags/roles.
Safer examples
1) Enforce authorization on the server for every action
The UI is just a convenience; the server must be the final gate (see CWE-286 / CWE-863).
2) Validate input server-side
Client-side validation improves UX but does not provide security (see CWE-20).
3) Recompute sensitive values server-side
Never trust client-sent price, role, or "paid" status (see B01 / API01).
How SiteShadow detects it (high level)
- Flags sensitive endpoints/operations where only client-side checks are apparent.
- Detects client-controlled flags being used to gate server-side actions.
References
- CWE-602: https://cwe.mitre.org/data/definitions/602.html
---