Why this lesson matters

Understand server-side authorization and use it correctly in an App Router project. Authentication proves identity while authorization protects data and mutations. Sessions and cookies transport trusted state, but server code must interpret that state at each protected boundary.

How to reason about it

  • For Server-side Authorization, the outcome to verify is: Do not rely on hiding a client button; final authorization must be enforced on the server.
  • In Server-side Authorization, keep this failure controlled: Checking authentication in navigation or middleware alone does not protect a server function that can still be called through another path.
  • Server-side Authorization practice target: Create a protected data function that distinguishes unauthenticated from forbidden access and call it from a server-rendered route.

Practical walkthrough

In the Server-side Authorization walkthrough: Do not rely on hiding a client button; final authorization must be enforced on the server.

authorization.tstypescript
export async function requireProjectAccess(projectId: string) {
  const session = await getSession();
  if (!session) throw new Error('UNAUTHENTICATED');
  if (!(await canAccessProject(session.userId, projectId))) throw new Error('FORBIDDEN');
}

Practice it yourself

Practice

Server-side Authorization exercise

Create a protected data function that distinguishes unauthenticated from forbidden access and call it from a server-rendered route.

  • Record the expected result before execution
  • Test one valid path and one lesson-specific failure path
  • Explain in two lines which boundary owns the decision

Summary