Feature Flags Server-Verified

Hiding a UI button behind a client-side feature flag is not access control — it is presentation logic. The API endpoint behind that button remains callable by anyone who can craft a request. CWE-602 (Client-Side Enforcement of Server-Side Security) names this pattern precisely: security controls that exist only in client code are not controls at all. OWASP A01 covers the broader failure of missing server-side authorization. An attacker who skips the UI and calls the API directly will exercise the gated feature regardless of any client-side useFeatureFlag check.

Client-side flag checks are UX — add the same check server-side in the API route or Server Action that actually executes the gated capability. The server-side check is what counts.

// app/api/generate/route.ts
export async function POST(req: NextRequest) {
  const session = await auth();
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });

  // Server-side enforcement — this is the real gate
  const hasFeature = await checkFeatureFlag('ai-generation', session.user.id);
  if (!hasFeature) return NextResponse.json({ error: 'Feature not enabled' }, { status: 403 });

  // ... proceed with gated action
}

The client-side flag can remain for UX — it just must not be the only gate.