I've implemented role based authorization. In my web site both "admin" and "user" have access to some page but "admin" has some additional functions available. Before loading that page I set visible = false for buttons which calls functions, forbidden for current user. I wonder: is it safe in this case to limit user actions only at UI level? or additional check of user rights required inside functions that are being called? or maybe there are some buit-in asp.net functionality to handle such case which i missed while reading books?
ps Any links to books or articles which cover that topic more thoroughly much appreciated
...
Go to the complete details ...