Client-Side Role Check — Do You Trust the Browser for Who's Admin?
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.
What the issue is
Checking admin status in the browser and letting the server trust it means anyone can flip 'isAdmin' in devtools and reach admin-only features.
Why AI tools generate it
AI tools put role checks in the UI because it's easy and visible, leaving the server to trust a client-supplied flag that's trivial to change.
How DevMeth detects it
A code scan looks for role checks that happen only in client code and are not re-verified server-side, flagging the trusting pattern.
Admins are checked in the browser — the server trusts the client
WHAT WE FOUND
app/dashboard/page.tsx — if (user.isAdmin) — client-only
The fix, in three steps
Enforce roles on the server from the session/token on every protected route and action; treat the client's claim as data, not authority. Three steps.
Run a free scan and each finding carries a paste-ready fix prompt you can act on.
Try a free scanFAQ
Can a user really change their role flag?
Yes — anything checked only in the browser runs on the visitor's machine, so an 'isAdmin' flag there is trivially editable in devtools.
Where should role checks live?
Only server-side, derived from the session or token — never from a value the client supplies.
What's the fix?
Enforce roles server-side from the session/token on every protected route and action, and ignore client-supplied role claims.
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.