Why this lesson matters

Understand sessions and cookies and use it correctly in an App Router project. Authentication proves identity while authorization protects data and mutations. Sessions and cookies transport trusted state, but server code must interpret that state at each protected boundary.

How to reason about it

  • For Sessions and Cookies, the outcome to verify is: Do not rely on hiding a client button; final authorization must be enforced on the server.
  • In Sessions and Cookies, keep this failure controlled: Checking authentication in navigation or middleware alone does not protect a server function that can still be called through another path.
  • Sessions and Cookies practice target: Create a protected data function that distinguishes unauthenticated from forbidden access and call it from a server-rendered route.

Practical walkthrough

In the Sessions and Cookies walkthrough: Do not rely on hiding a client button; final authorization must be enforced on the server.

authorization.tstypescript
export async function requireProjectAccess(projectId: string) {
  const session = await getSession();
  if (!session) throw new Error('UNAUTHENTICATED');
  if (!(await canAccessProject(session.userId, projectId))) throw new Error('FORBIDDEN');
}

Practice it yourself

Practice

Sessions and Cookies exercise

Create a protected data function that distinguishes unauthenticated from forbidden access and call it from a server-rendered route.

  • Record the expected result before execution
  • Test one valid path and one lesson-specific failure path
  • Explain in two lines which boundary owns the decision

Summary