CWE-603 (使用客户端的认证机制) — Vulnerability Class 19

CWE-603 represents a critical architectural flaw where authentication logic is implemented exclusively within client-side code, leaving the server-side validation incomplete or absent. This weakness is typically exploited by attackers who reverse-engineer the client application to understand the authentication mechanism, then modify the client code to bypass the local checks entirely. By omitting the authentication step in the modified client, attackers can directly access protected resources or perform unauthorized actions, effectively circumventing security controls. To avoid this vulnerability, developers must ensure that all critical security decisions, including identity verification and authorization checks, are performed strictly on the server side. Client-side mechanisms should only serve as user experience enhancements or input validation aids, never as the sole gatekeeper for sensitive operations, thereby ensuring that security cannot be trivially bypassed through code manipulation.