- Home
- The 17 checks
- Admin access is decided in the browser
🔐 Logins · Fix soon (SEV-2)
Admin access is decided in the browser
In plain English: Your app decides who is an admin using a value kept in the visitor's own browser. Anyone can change that value in a few seconds and give themselves admin powers.
What happens if you ship it
Someone opens dev tools, changes one value, and becomes an admin.
How to fix it technical
Store roles in the database and check them on the server for every protected action. Treat anything in the browser as user input.
Let your AI tool fix it
Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:
Prompt for your AI tool
Fix this problem in my project: Admin access is decided in the browser. Store roles in the database and check them on the server for every protected action. Treat anything in the browser as user input. Change only what this fix needs, then tell me what you changed and anything I have to do myself.Check your app
Run npx sigship in your project folder. It reports this problem as role-in-local-storage, along with 16 other checks. Nothing leaves your computer. New to the terminal?
Questions
Why is localStorage not safe for roles?
Visitors control everything in their browser, including localStorage. Anything stored there should be treated as something the user typed.
Where should user roles live?
In your database, checked by your server or by database rules every time someone tries a protected action.