Protect administrative surfaces

Administrative interfaces can change users, money, access, and production behavior. That impact makes them the highest-value target, and a secret-looking path like /admin-x7f2 is not an authorization system. Anyone who learns the URL reaches it.

An administrator follows a saved link after leaving a privileged session open all day. A stolen browser session can now delete users without fresh proof.

Require role, then require freshness

Every admin operation needs an explicit role check on the server, not a hidden route and not a client-side menu that simply hides buttons.

function requireAdmin(req, res, next) {
  if (req.user?.role !== 'admin') return res.status(403).end()
  next()
}

High-impact changes need more than a valid session. Require recent authentication or MFA so a long-lived stolen session cannot perform them.

function requireRecentAuth(req, res, next) {
  const age = Date.now() - req.session.authAt
  if (age > 5 * 60 * 1000) return res.status(401).json({ reauth: true })
  next()
}

app.post('/admin/users/:id/delete', requireAdmin, requireRecentAuth, deleteUser)

Record a complete audit event for every attempt, keep normal accounts separate from admin use, and narrow network exposure where practical.

Requiring MFA for every small admin read can slow routine work. Reserve recent authentication and explicit confirmation for high-impact changes, while authorizing every operation.

Test one destructive admin action as an ordinary user, an administrator with a stale session, and an administrator with fresh proof. Verify the first two fail, the third succeeds, and every attempt produces an audit event.