I am building a simple application with base64 token authentication. To be more secure, one should use CSFR protection. Additionally I want to avoid any kind of framework or library to really understand every step.

I arrived at the point where I send a fetch request with an "Authentication: Basic <base64 token>" header. To store that token you need some sort of state management, cookie or localStorage solution. For simplicity I landed on sessionStorage, but I immediately saw the danger:
On the admin page I had a if (!sessionStorage.token) window.location.href = "/"; statement. That could easily be manipulated with the browsers developer tools.

That got me wondering, how do you actually validate an active user session?

• the cookie name could be set with the developer tools
• obviously any kind of localStorage / sessionStorage solution, too

Is it really just possible with a state management solution?
Does the content of a cookie need to be validated with an additional fetch request?
Could I simply pass the token alongside the GET request for the admin page and be done with it?