Next.js
/Intermediate
Role-Based Access Control
Definition
RBAC: An authorization strategy where permissions are assigned to specific roles (Admin, Editor, Viewer), and users are granted those roles.
Explain Like I'm New
A standard user logs in and sees 'View Article'. An Admin logs in and sees 'View Article' AND 'Delete Article'. The system checks their 'role' before rendering UI elements or allowing API requests.
Real World Example
A SaaS application with 'Free Tier' and 'Pro Tier' users. Pro users are authorized to access the `/advanced-analytics` route, while Free users are blocked.
Common Use Cases
- •SaaS applications
- •Admin panels
- •Enterprise software
Interactive Example
// app/api/delete-user/route.ts import { getAuth } from '@/lib/auth'; export async function POST(request: Request) { const user = await getAuth(); // 1. AUTHENTICATION (Are they logged in?) if (!user) return Response.json({ error: 'Unauthorized' }, { status: 401 }); // 2. AUTHORIZATION (Are they an Admin?) if (user.role !== 'ADMIN') { return Response.json({ error: 'Forbidden. Admins only.' }, { status: 403 }); } // 3. Safe to perform destructive action await db.deleteUser(); return Response.json({ success: true }); }
Interview Questions
basic
- If Authentication answers 'Are you logged in?', what does Authorization answer?
intermediate
- Why is it critical to check user roles on the Server/API, rather than just hiding the 'Delete' button in the React UI?