Remembering that we can't trust client-side authorization checks alone, the final change we need to make to prevent admin users placing orders is to protect the API endpoint that stores the order and processes the payment information. Open up the Features/Orders/Controller.cs file and amend it as follows:
[HttpPost, Authorize(Roles = "Customer")]
public async Task<IActionResult> Create([FromBody] CreateOrderViewModel model)
{
//...method body omitted for brevity
}
That's all there is to it. In this instance, we only allow the single Customer role to place orders, but if we had multiple roles, then we could pass a comma-separated list of roles here instead.
