Static sites need server-side auth for real protection

Static-site authentication has a hard boundary.

A browser can run Firebase, Logto, or PocketBase SDKs and show a different UI after login, but hidden frontend content is not truly protected.

If the asset is shipped to the browser, assume it can be inspected.

For real protection, validate identity in a trusted environment: Cloudflare Workers, Pages Functions, Firebase Functions, a Node backend, FastAPI, or another server-side layer.

That layer checks tokens, cookies, or sessions before returning private data or running privileged actions.

Client auth is UX. Server-side validation is enforcement.

Related:

• Serverless
• Firebase Auth SDK. Social Login and email verification.
• FrontEnd 101. SPAs and ways to do Auth
• Payroll Workers PocketBase repo
• Serverless Invoices repo
• Slidev Editor Firebase auth branch
• Slidev Editor Logto auth branch