Anything in the browser can be changed

Anything that comes from the browser can be written by the person using it: hidden buttons, data in the address, form fields, local storage. Hiding a "Delete users" button protects nothing, because the attacker sends the request directly, without going through the button.

The most common flaw: the number snooper

If the address says /pedido/1042 (pedido means order) and the server doesn't check whose order that is, someone changes the number to 1043 and sees another person's. It's called IDOR (insecure direct object reference) and it's one of the most frequent flaws.

A different flaw is deciding permissions with data the browser sends, like ?es_admin=false ("is admin = false"): changing it to true is the first thing an attacker tries. That's not an IDOR: it's called privilege escalation, because the person gives themselves more permissions than they have.

What a good guard does

Every time a request arrives, the server always follows the same order: it identifies who you are from your session, checks what role and permissions you have, confirms that the requested data is yours or that you have permission over it, and only then performs the action or returns the data. Skipping a step opens a hole.

// BAD: returns whatever order the address asks for, no matter whose it is
app.get("/pedido/:id", async (pedido) => {
  return await buscarPedido(pedido.params.id);
});

// GOOD: returns it only if it belongs to the person asking
app.get("/pedido/:id", async (pedido) => {
  const p = await buscarPedido(pedido.params.id);
  if (!p || p.usuarioId !== pedido.usuario.id) return noEncontrado();
  return p;
});