Role-Based Authorization
A role can be copied from a trusted backend into token/session claims. The browser-visible role may hide or show controls, but the server must check the role before privileged operations. For high-risk actions, fetch current permissions from the database or authorization service.
Admin-only API check
if (!session) return res.status(401).json({ error: "Unauthorized" });
if (session.user?.role !== "admin") {
return res.status(403).json({ error: "Forbidden" });
}
// Perform the privileged operation only after the checks.💡 Place this check before the privileged operation. Do not trust a role supplied by the browser.