Trial period enforces feature limits

A trial period stored in a cookie, localStorage, or a client-resettable field is effectively no trial at all — users can restart it indefinitely by clearing storage or creating new accounts. CWE-284 (Improper Access Control) and CWE-602 (Client-Side Enforcement of Server-Side Security) apply. OWASP A01 (Broken Access Control) lists this under privilege escalation. The trial must be fully managed by the payment provider: Stripe tracks trial_end, emits customer.subscription.trial_will_end three days before expiry, and transitions the status automatically.

Let Stripe own the trial lifecycle. Store only the subscription.status from Stripe webhooks — when it transitions from trialing to active or past_due, your webhook handler updates the database accordingly.

// When creating a subscription with trial via Stripe:
await stripe.subscriptions.create({
  customer: customerId,
  items: [{ price: priceId }],
  trial_period_days: 14,
})
// Stripe emits customer.subscription.trial_will_end 3 days before expiry
// and customer.subscription.updated when trial ends (status → active or past_due)

In your webhook handler, treat trialing the same as active for access decisions, and revoke access when subscription.status moves to any non-active state. Never read trial state from the client.