The admin button
Only admins see the Refund button. A regular user has just refunded their own last three orders.
This answers: Is hiding the admin button enough? No coding needed. 3 quick decisions.
- Who is signed in
- Who may see what
- Debugging without panic
Checking your access…
Is hiding the admin button enough?
No. Hiding a button only changes what is shown. Anyone can send the same request without the button. Every sensitive endpoint must check the caller's role on the server, reading that role from your database or a verified session, never from the request body.
Breaks at Your server: Endpoint never checks the role
Why AI tools write this bug
Generated UIs often wrap admin features in a condition like if (user.role === 'admin'), which looks like protection. The endpoint behind it is generated separately and frequently has no check at all.
How to fix it
- Check the role inside the endpoint or server action, before doing anything.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Can I trust a role sent in the request body?
- No. Anything in a request was written by the person sending it, including role: 'admin'.