2026-10-29 · Daily security tips

Is your login check only in the frontend?

A common mistake in AI-built apps: the app hides the admin page or redirects logged-out users in the browser, but the API routes and database behind it never check who is asking.

Check: log out, open DevTools > Network, and replay one of your app's data requests (right-click > Copy as cURL). If it still returns data, your backend is not checking auth. Also try changing a user_id or record id in a request to someone else's.

Fix: verify the session on the server in every API route or server action, and take the user's id from the verified session, never from the request body. On Supabase, back this with RLS policies so the database enforces it too.

The frontend is for convenience. The server decides who sees what.