Sveltejs Academy · Lesson

Protected Routes in handle() Hook

Redirect unauthenticated users from protected routes inside the handle hook.

Lesson 3 of 413 steps

Protected Routes in handle() Hook is a free Sveltejs Academy lesson on CoddyKit. This is lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Sveltejs Academy learning path, and your progress syncs across the web and the CoddyKit app. The Sveltejs Academy course includes 4 lessons in total.

Protect at the Edge

Centralize route protection in the handle hook for one source of truth.

Check Locals

If you set event.locals.user in handle, check it for protected paths.

export async function handle({ event, resolve }) {
  event.locals.user = await getUser(event);
  if (event.url.pathname.startsWith("/admin") && !event.locals.user) {
    return new Response("Unauthorized", { status: 302, headers: { Location: "/login" } });
  }
  return resolve(event);
}

Role-Based Access

Check user roles to gate sections.

if (event.url.pathname.startsWith("/admin") && event.locals.user?.role !== "admin") redirect(...);

Load Function Backup

Inside +page.server.js load, throw redirect if locals.user is missing for extra safety.

Public vs Private Routes

Use a path matcher or layout boundaries to differentiate.

Avoid Per-Page Checks

Centralized checks prevent missed routes that could expose sensitive data.

Return URL

Encode the original URL as a query param so users return after login.

redirect(303, `/login?next=${encodeURIComponent(event.url.pathname)}`);

API Routes

Protect API endpoints (+server.js) with the same hook logic.

Performance

Auth checks should be fast. Cache user data per request via locals.

SSR Consistency

Centralized auth ensures consistent behavior on server-rendered and client-navigated requests.

Testing

Hook-based auth is easier to test in isolation than scattered per-page checks.

Quick Check

Where should you do route protection?

Answer it in the interactive lesson

Recap

Centralize route protection in handle, checking locals.user and redirecting unauthorized requests.

Free to start

Learn HTML with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 41
Lessons: 163

Start learning free View the full course

Frequently Asked Questions

Is the “Protected Routes in handle() Hook” lesson free?

Yes — the full text of “Protected Routes in handle() Hook” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Sveltejs Academy course, upgrade to CoddyKit PRO. The Sveltejs Academy course includes 4 lessons in total.

What will I learn in “Protected Routes in handle() Hook”?

Redirect unauthenticated users from protected routes inside the handle hook. You practise Sveltejs Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Sveltejs Academy?

No prior experience is required. Sveltejs Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 3 of 4.

How long does the “Protected Routes in handle() Hook” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Sveltejs Academy lesson?

Yes. Every Sveltejs Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Sveltejs Academy