Guest checkout option available without account creation

Forcing account creation before checkout is the single highest-impact abandonment driver in e-commerce — Baymard Institute's research consistently places mandatory registration at the top of checkout usability failures. OWASP A01:2021 (Broken Access Control) applies when auth middleware blocks a business-critical flow without a bypass: it is a misapplication of access control that excludes legitimate paying customers. CWE-306 (Missing Authentication for Critical Function) names the inverse failure — but the cart-checkout direction is an over-application, not an absence. Requiring signup before payment costs conversions directly and measurably.

Add a guest bypass at the checkout entry point in src/components/CheckoutInitiation.tsx (or src/app/checkout/page.tsx) that skips auth middleware when the user selects guest mode. Remove any unconditional redirect('/login') guards from src/app/checkout/layout.tsx and replace with a conditional:

// src/app/checkout/layout.tsx
if (!session && !searchParams.get('guest')) {
  redirect('/login?redirect=/checkout')
}

Then render both options at the checkout entry:

// src/components/CheckoutInitiation.tsx
<button onClick={() => router.push('/checkout?guest=1')}>Continue as Guest</button>
<button onClick={() => router.push('/login?redirect=/checkout')}>Sign In</button>

Ensure the guest path collects only the fields required to complete the order (email for receipt, shipping address, payment) without creating a password.

• ID: ecommerce-cart-ux.checkout-flow.guest-checkout

• Severity: critical

• What to look for: Trace the path from cart to the first checkout step. Count all auth gates encountered (login redirects, auth middleware, useSession guards, route protection). For each gate, check if a guest/skip bypass exists. Quote the auth check code — e.g., if (!session) redirect('/login') in src/app/checkout/layout.tsx. List all checkout entry points and classify each as: (a) open to guests, (b) requires authentication, (c) offers both options.

• Pass criteria: At least 1 checkout entry path allows completing a purchase without creating an account. Guest checkout option is visible on the first checkout-related page (not behind a menu or settings). No more than 0 hard auth redirects exist without a guest bypass. Report: "X checkout entry points found, Y allow guest access."

• Fail criteria: Checkout requires account creation before proceeding. All checkout routes are behind auth middleware with no guest bypass.

• Do NOT pass when: A "Continue as Guest" button exists but still requires an email + password to proceed — that is account creation with different labeling.

• Skip (N/A) when: The project does not have a checkout flow (informational site, no payment processing).

• Detail on fail: Example: "Checkout at src/app/checkout/layout.tsx redirects to /login via auth middleware. 0 of 1 checkout entry points allow guest access. No 'Continue as Guest' option visible."

• Cross-reference: For auth flow security patterns, the Auth & Session Security audit covers session management. For the minimal-fields check on what guest checkout should collect, see the minimal-fields check in Address & Form Handling.

• Remediation: Add a guest checkout option at the checkout entry point, typically src/app/checkout/page.tsx or src/components/CheckoutInitiation.tsx:

  // src/components/CheckoutInitiation.tsx
  function CheckoutInitiation() {
    return (
      <div>
        <button onClick={() => startCheckout('authenticated')}>
          Sign In
        </button>
        <p>-- or --</p>
        <button onClick={() => startCheckout('guest')}>
          Continue as Guest
        </button>
      </div>
    )
  }