# Guest checkout option available without account creation

- **Pattern:** `ab-001101` (`ecommerce-cart-ux.checkout-flow.guest-checkout`)
- **Severity:** critical
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-001101
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-001101)

## Why it matters

Forcing account creation before checkout is the single highest-impact abandonment driver in e-commerce — Baymard Institute's research consistently places mandatory registration at the top of checkout usability failures. OWASP A01:2021 (Broken Access Control) applies when auth middleware blocks a business-critical flow without a bypass: it is a misapplication of access control that excludes legitimate paying customers. CWE-306 (Missing Authentication for Critical Function) names the inverse failure — but the cart-checkout direction is an over-application, not an absence. Requiring signup before payment costs conversions directly and measurably.

## Severity rationale

Critical because mandatory registration before payment is the leading conversion killer in checkout flows, with direct, immediate revenue impact on every guest purchase attempt.

## Remediation

Add a guest bypass at the checkout entry point in `src/components/CheckoutInitiation.tsx` (or `src/app/checkout/page.tsx`) that skips auth middleware when the user selects guest mode. Remove any unconditional `redirect('/login')` guards from `src/app/checkout/layout.tsx` and replace with a conditional:

```tsx
// src/app/checkout/layout.tsx
if (!session && !searchParams.get('guest')) {
  redirect('/login?redirect=/checkout')
}
```

Then render both options at the checkout entry:

```tsx
// src/components/CheckoutInitiation.tsx
<button onClick={() => router.push('/checkout?guest=1')}>Continue as Guest</button>
<button onClick={() => router.push('/login?redirect=/checkout')}>Sign In</button>
```

Ensure the guest path collects only the fields required to complete the order (email for receipt, shipping address, payment) without creating a password.

## Detection

- **ID:** `guest-checkout`
- **Severity:** `critical`
- **What to look for:** Trace the path from cart to the first checkout step. Count all auth gates encountered (login redirects, auth middleware, `useSession` guards, route protection). For each gate, check if a guest/skip bypass exists. Quote the auth check code — e.g., `if (!session) redirect('/login')` in `src/app/checkout/layout.tsx`. List all checkout entry points and classify each as: (a) open to guests, (b) requires authentication, (c) offers both options.
- **Pass criteria:** At least 1 checkout entry path allows completing a purchase without creating an account. Guest checkout option is visible on the first checkout-related page (not behind a menu or settings). No more than 0 hard auth redirects exist without a guest bypass. Report: "X checkout entry points found, Y allow guest access."
- **Fail criteria:** Checkout requires account creation before proceeding. All checkout routes are behind auth middleware with no guest bypass.
- **Do NOT pass when:** A "Continue as Guest" button exists but still requires an email + password to proceed — that is account creation with different labeling.
- **Skip (N/A) when:** The project does not have a checkout flow (informational site, no payment processing).
- **Detail on fail:** Example: `"Checkout at src/app/checkout/layout.tsx redirects to /login via auth middleware. 0 of 1 checkout entry points allow guest access. No 'Continue as Guest' option visible."`
- **Cross-reference:** For auth flow security patterns, the Auth & Session Security audit covers session management. For the minimal-fields check on what guest checkout should collect, see the minimal-fields check in Address & Form Handling.
- **Remediation:** Add a guest checkout option at the checkout entry point, typically `src/app/checkout/page.tsx` or `src/components/CheckoutInitiation.tsx`:

  ```tsx
  // src/components/CheckoutInitiation.tsx
  function CheckoutInitiation() {
    return (
      <div>
        <button onClick={() => startCheckout('authenticated')}>
          Sign In
        </button>
        <p>-- or --</p>
        <button onClick={() => startCheckout('guest')}>
          Continue as Guest
        </button>
      </div>
    )
  }
  ```

## External references

- cwe CWE-306
- owasp A01

Taxons: user-experience, access-control

HTML version: https://auditbuffet.com/patterns/ab-001101