Web Security · Middle · Question 58 of 75

An admin button is hidden in the UI for regular users. Is that access control?

1Yes, if the JavaScript bundle is obfuscated
✓Correct answer: No: the API behind the button must check the role, because anyone can call it directly
3Yes, if the button is removed from the DOM

Explanation

UI hiding is only for user experience. Authorization belongs on the server for every endpoint.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.