- User logs in, API sends profile data to the UI including whether a user is an admin or not

- User tries to edit something sensitive, UI has profile data so disallows the action if the user is not an admin

- User pokes around the browser console to see what request would have been sent had the user been an admin and the UI allowed it

- User manually sends malicious admin request to API

- API fails to check whether admin request came from a user with admin rights and blindly executes the malicious action

How about putting the quotes around a value in JavaScript to prevent a DB error when the server concatenates it into a SQL statement later? There was even a helpful comment in the page source to explaining what was happening. I sent an email but it wasn't answered.

I found this on a mapping site (now defunct) that let you printout sections of maps for a change. However, you could get small sample maps for free. And so by altering the width and height parameters in the page source ...

This wasn't mean't as a dig at frontend devs. After all the backend used the values as passed, and there should be some archtectural oversight to ensure this sort of sloppiness doesn't pass review. It's really a case of incompetent all round.

As dev I see a push to put more and more functionality into the client. It makes for a better user experience, but the downside is that security gets overlooked.

I'm imagining doing some client side validation and then the server just blindly assumes the content has been validated.