From Dev.to
Access control belongs in the database, not the UI
The most common access-control bug I see isn't exotic. It's this: the app hides a button, and the developer calls it done. But the data is still one crafted request away. If authorization only lives i...