CWE-602 Client-Side Enforcement of Server-Side Security

Coverage: 6 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 6 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged a pattern where a security control appears to be enforced only in the client (UI), but not enforced on the server (API). Attackers can bypass the UI and call the server directly.

Why it matters

Client-side controls can be bypassed by attackers.

• Authorization bypass: hidden buttons don't stop API calls.
• Business logic abuse: client-side validation can be skipped or modified.
• Privilege escalation if the server trusts client-side flags/roles.

Safer examples

1) Enforce authorization on the server for every action

The UI is just a convenience; the server must be the final gate (see CWE-286 / CWE-863).

2) Validate input server-side

Client-side validation improves UX but does not provide security (see CWE-20).

3) Recompute sensitive values server-side

Never trust client-sent quota, role, or access status (see B01 / API01).

How SiteShadow detects it (high level)

• Flags sensitive endpoints/operations where only client-side checks are apparent.
• Detects client-controlled flags being used to gate server-side actions.

References

• CWE-602: https://cwe.mitre.org/data/definitions/602.html

---

← Back to Vulnerability Library