This is probably not very secure. You should write the logic for checking whether the user is signed in on the server, and keep track of the session in another way. When not signed in, the endpoints should return authentication failures as 403 error codes and you should handle them accordingly on the frontend.