I want to show secured data only to admins. In NextAuth->callbacks->session I'm checking database if user has admin privileges and add isAdmin flag. I don't know if this is most secured way and can anyone by doing fake request force getSession to give me wrong data.
export async function getServerSideProps(context) {
const session = await getSession(context);
if(session && session.isAdmin) {
..
There is alot of ways that you could do this.
When you get the user from the database after the login you could have a field called roles or role.
For example when user goes to the protect page/pages you could do a server side validation.
export async function getServerSideProps({ req }: any) {
const session = await getSession({ req });
const user = session?.user;
if(user.role!=="admin")
{
custom logic or return the user to another page etc
}
}