403 Forbidden: Nopelican
403Forbidden
NopelicanHard NoOh, it's you? Not letting you in!What it means
Your identity is known, but you lack permission.
Where you meet it
A regular user opens the admin panel.
What to test
- Log in as a regular user and open an admin URL by direct link (e.g., /admin) → the admin page doesn't open (no access, a login page or a 404, as the requirements say).
- Log in as user A, open one of your orders and change the id in the URL to user B's order → B's order is not shown.
- As an admin, copy the request of an admin-only action from DevTools; as a regular user, send the same request → status 403, nothing changes.