Agent WranglersAccess and accounts Required
Check roles on every action
Check the user's role on the server for every admin or staff action. Hiding a button is not a check.
How to do it
Put the role check in one place, such as middleware on the whole admin route. Test each action, not only each page. Keep the list of roles small.
How to check
As a normal user, call every admin address and API action found in the code, the scripts and the sitemap. Every call returns 403 or 404.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/function-access.