Q:

What are the security risks of storing user roles/types in a cookie?

Recently I had to use a website which stored things like user role (user or admin) in a cookie.
When I modified the username the displayed username changed in the website.
I immediately asked the developers of said website if it's secure to store the user role in a cookie if you can just modify it. They told me that you could only break the UI of said website and that the back-end always checks the session cookie for important actions.
So let's say I want to build my own website and store things like user-type: admin or user in a cookie.
Is it safe to store the user type in a cookie if it's only used for UI purposes and not back-end purposes?

A:

"Safe" is always a relative term. If the data in the cookie is not used for authentication or authorisation, and it is just a configuration item that is exposed and could be used by anyone without a risk of misuse/abuse, then why not? The letters a d m i n are not special in and of themselves.
At that point, it's just a UI toggle switch, just like dark/light mode. 
The real question is about knowing the potential impacts of such a change.
The risks are about some future developer of the site misusing the cookie for sensitive things without understanding the consequence. 

