Creating a Navigation Menu Based on User Roles

Role-aware navigation shows users the actions available to them. It improves usability, but server-side checks remain responsible for security.

Start with a protected page

<?php
require __DIR__ . "/includes/require-login.php";

$username = $_SESSION["username"] ?? "user";
$role = $_SESSION["role"] ?? "user";
?>

<nav aria-label="Main navigation">
  <ul>
    <li><a href="dashboard.php">Dashboard</a></li>
    <li><a href="results.php">Results</a></li>

    <?php if ($role === "admin"): ?>
      <li><a href="import.php">Import dataset</a></li>
      <li><a href="manage-users.php">Manage users</a></li>
    <?php endif; ?>

    <li><a href="logout.php">Log out</a></li>
  </ul>
</nav>

<p>
  Signed in as
  <?= htmlspecialchars($username, ENT_QUOTES, "UTF-8") ?>
</p>

Protect every destination

The condition only controls whether the link appears. import.php and every other administrator route must also require includes/require-admin.php.

Do not use JavaScript or CSS visibility as an access-control mechanism. Those technologies run in the user’s browser and can be changed.

Design guidance

Use descriptive link text.
Identify the current page with aria-current="page".
Keep navigation order consistent.
Do not display links that will always deny the current role.
Provide a visible logout action.
Ensure keyboard focus is clear in CSS.

Test

Compare logged-out, standard-user and administrator views. Then type each protected URL directly to verify that hidden links are not the only control.

Check

Standard users see standard actions.
Administrators see administrative actions.
Every destination enforces access independently.
Navigation is labelled and keyboard accessible.
Session text is escaped.