Navigation prevents navigating back to initial/splash screen
Why it matters
When a user presses back after completing login or onboarding and returns to the splash screen, they reach a pre-auth state while already authenticated — a CWE-862 (Missing Authorization Check) scenario where the auth gate is bypassed by navigating backwards through the stack. Beyond security, splash-screen return is a confusing dead end: users see a loading screen with no active content, often conclude the app has crashed, and close it. At minimum, you lose engagement; in apps with payment or subscription flows, back-navigation to the splash can expose a path to bypass gating.
Severity rationale
Medium because post-auth back-navigation to splash screens bypasses auth gating (CWE-862) and presents a UX dead-end that causes user abandonment, though exploitation requires physical device access.
Remediation
Use conditional navigator groups keyed on auth state rather than manual navigation.reset() calls — this is more reliable and eliminates the entire class of problem. In src/navigation/RootNavigator.tsx:
function RootNavigator() {
const { user } = useAuth() // your auth context
return (
<Stack.Navigator screenOptions={{ headerShown: false }}>
{user ? (
// Authenticated group — back button never reaches unauthenticated screens
<Stack.Group>
<Stack.Screen name="Home" component={HomeScreen} />
<Stack.Screen name="Settings" component={SettingsScreen} />
</Stack.Group>
) : (
// Unauthenticated group — rendered with no animation to avoid flash
<Stack.Group screenOptions={{ animationEnabled: false }}>
<Stack.Screen name="Splash" component={SplashScreen} />
<Stack.Screen name="Login" component={LoginScreen} />
</Stack.Group>
)}
</Stack.Navigator>
)
}
Swapping groups on auth state change resets the stack automatically — no CommonActions.reset() boilerplate needed, and back navigation is structurally impossible between groups.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Mobile Navigation & Deep Linking Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-862 — Missing Authorization
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mobile-navigation-linking·automated