Client-Side Route Guard and Identity Bypass via LocalStorage Manipulation (Security Vulnerability)

[Adithyakp86]

[BUG / SECURITY]: Client-side Route Guard and Identity Bypass via LocalStorage Manipulation

Description

The application relies on localStorage values (userType and userId) for client-side routing access control and to dynamically fetch user data. A user can easily bypass route-guards and impersonate other users/roles by manually modifying their local storage properties in the browser developer console.

Locations affected

• components/Auth/AuthCheck.js
• pages/doctor/dashboard.js
• pages/doctor/alerts.js
• pages/appointments.jsx

Steps to Reproduce

1. Visit the home page (unauthenticated).
2. Open the browser Developer Console.
3. Run:

   localStorage.setItem("userType", "doctor");
   localStorage.setItem("userId", "impersonated-doctor-id");
   localStorage.setItem("username", "Dr. Impostor");

4. Navigate manually to /doctor/dashboard.
5. The AuthCheck component will allow access because it validates the existence of the userType value directly from local storage.
6. The dashboard attempts to retrieve patients using these spoofed IDs.

Expected Behavior

Access control and authentication details should be verified on the server side using secure session claims (e.g. Clerk token or Firebase Session cookies) instead of easily modifiable local storage values.

Proposed Solution

Refactor client-side layout guards to consume the global authentication state from useUser() (Clerk) or UserContext instead of querying localStorage.

[github-actions]

Thank you for raising this issue!

We'll review it as soon as possible. We truly appreciate your contributions! ✨

Meanwhile make sure you've visited the README.md, CONTRIBUTING.md, and CODE_OF_CONDUCT.md before creating a PR for this. Also, please do NOT create a PR until this issue has been assigned to you. 😊

[github-actions]

Thanks for opening this issue! 🚀

Please adhere to Apertre'26 Rules:

1. Do NOT create a PR until this issue is assigned to you.
2. Include apertre3.0 tag.
3. Provide ONE Difficulty Tag (easy / medium / hard).
4. Include screenshots if it's UI-related.

A mentor will review and assign this issue soon.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 7 days.