Admin Routes Protected with Role Check

An admin route that checks if (!session) but not if (session.user.role !== 'admin') is accessible to every authenticated user in the application. This exposes user management, system configuration, and privileged operations to any account holder. CWE-285 (Improper Authorization) and CWE-284 (Improper Access Control) define this failure precisely. OWASP A01 (Broken Access Control) lists this as a primary failure mode. NIST 800-53 AC-3 and AC-6 require that admin operations enforce both authentication and the specific privilege level required — the authentication check alone is necessary but not sufficient.

Use middleware.ts to enforce admin role checks across the entire /admin path group before requests reach individual handlers. Keep role checks in handlers as well for defense in depth.

// middleware.ts
export async function middleware(req: NextRequest) {
  const token = await getToken({ req });

  if (req.nextUrl.pathname.startsWith('/admin')) {
    if (!token) return NextResponse.redirect(new URL('/login', req.url));
    if (token.role !== 'admin') return NextResponse.redirect(new URL('/403', req.url));
  }

  return NextResponse.next();
}

export const config = {
  matcher: ['/admin/:path*', '/api/admin/:path*'],
};

Middleware can be bypassed in some configurations — individual admin API handlers should also check session.user.role === 'admin' as a second line of defense.