I didn’t know this kind of attack before but wouldn't any sane backend system confirm the permissions of requesting client first before handing out admin pages?

I didn’t know this kind of attack before but wouldn't any sane backend system confirm the permissions of requesting client first before handing out admin pages? I mean you need to have a client-id and their permissions for any outside request coming to server. I’m using Golang in my webserver but it wouldn’t hand-out secret pages as requesting client wouldn’t have authority to do so. I feel like Golang's UTF8 handling is the least of the worries for these kinds of attacks, it points out that entire backend system was constructed wrongly, number one rule of any backend systems: You cannot trust the client.