Can a user really change their role flag?

Yes — anything checked only in the browser runs on the visitor's machine, so an 'isAdmin' flag there is trivially editable in devtools.

Where should role checks live?

Only server-side, derived from the session or token — never from a value the client supplies.

Enforce roles server-side from the session/token on every protected route and action, and ignore client-supplied role claims.

C17

Access & auth

Client-Side Role Check — Do You Trust the Browser for Who's Admin?

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.

What the issue is

Checking admin status in the browser and letting the server trust it means anyone can flip 'isAdmin' in devtools and reach admin-only features.

Why AI tools generate it

AI tools put role checks in the UI because it's easy and visible, leaving the server to trust a client-supplied flag that's trivial to change.

How DevMeth detects it

A code scan looks for role checks that happen only in client code and are not re-verified server-side, flagging the trusting pattern.

C17

What a finding looks like

Critical

Admins are checked in the browser — the server trusts the client

WHAT WE FOUND

app/dashboard/page.tsx — if (user.isAdmin) — client-only

Sample — illustrative and masked exactly as a real report shows it. Run a free scan to see your own results.

The fix, in three steps

Enforce roles on the server from the session/token on every protected route and action; treat the client's claim as data, not authority. Three steps.

Run a free scan and each finding carries a paste-ready fix prompt you can act on.

Try a free scan

FAQ

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.