Hiding Buttons Is Not Authorization
Added 2026-10
Hiding Buttons Is Not Authorization — Chinese original prompt
前端根据角色隐藏了 [功能入口]，后端接口却只校验是否登录。请逐个核对被隐藏功能对应的接口，确认服务端有独立的权限判断，并补齐缺失的校验。输出：入口与接口的对应表、每个接口当前的校验情况、需要补的权限点、以及验证方式（用低权限账号直接调用接口）。
Site original
Chinese original
Example
Sample input
前端按角色隐藏了退款入口，后端只校验是否登录，逐个核对并补齐权限判断。
The output should include
- 给出入口与接口的对应清单
- 每个接口当前的校验情况列清
- 用低权限账号直调接口验证
Replace these placeholders 1
Swap the bracketed parts for your own details before sending.
[功能入口]
How to use
权限判断要基于服务端的当前角色，别信前端传来的角色或菜单标识。
Try tweaking it
- Have it restate requirements and constraints before writing code.
- Ask for the smallest change plus a rollback path, not a full-file rewrite.
What you should get
- A minimal, runnable change with copy-ready code
- Impact list: which files and call sites must follow
Common mistakes
- Asking it to touch ten files at once, then losing track of what broke what.
- Pasting only the error, with no code or version, and getting an unfixable answer.
How to check the output
- The change runs, can be rolled back, and touches nothing unrelated.
- Edge cases (empty, oversized, concurrent) are covered or explained.
Where it works
- Good for: having it restate requirements and constraints, then propose the smallest runnable change.
- Watch out: include versions and a minimal reproduction with the error, or the fix may look plausible but not fit.