Server-based apps check for a session cookie before returning any content to the user. If an authentication cookie isn't sent from the user's browser, the only content delivered to the user is a redirect/error message.
I'm new to server-less apps. In the several Javascript S3/Cognito-based tutorials I saw (for example AWS' WildRydes), this authentication is client-based. It's triggered only after the entire page has loaded and then redirects to a login page.
Isn't that a fundamental flaw? what stops an unauthenticated user from viewing the page before the redirect?