A client-side ProtectedRoute (or a page that only checks “is the user logged in?”) keeps honest users out of a screen. It does not stop a crafted request to DELETE /api/projects/42.
Authorize on every server handler: subject, action, and the specific resource id. Treat the UI as a convenience layer, not the policy enforcement point.
If the API allows what the UI hides, you have permission theater — not access control.
Top comments (0)