Protected Routes in handle() Hook
Redirect unauthenticated users from protected routes inside the handle hook.
Protected Routes in handle() Hook is a free Sveltejs Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Sveltejs Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Protect at the Edge
Centralize route protection in the handle hook for one source of truth.
Check Locals
If you set event.locals.user in handle, check it for protected paths.
export async function handle({ event, resolve }) {
event.locals.user = await getUser(event);
if (event.url.pathname.startsWith("/admin") && !event.locals.user) {
return new Response("Unauthorized", { status: 302, headers: { Location: "/login" } });
}
return resolve(event);
}Role-Based Access
Check user roles to gate sections.
if (event.url.pathname.startsWith("/admin") && event.locals.user?.role !== "admin") redirect(...);Load Function Backup
Inside +page.server.js load, throw redirect if locals.user is missing for extra safety.
Public vs Private Routes
Use a path matcher or layout boundaries to differentiate.
Avoid Per-Page Checks
Centralized checks prevent missed routes that could expose sensitive data.
Return URL
Encode the original URL as a query param so users return after login.
redirect(303, `/login?next=${encodeURIComponent(event.url.pathname)}`);API Routes
Protect API endpoints (+server.js) with the same hook logic.
Performance
Auth checks should be fast. Cache user data per request via locals.
SSR Consistency
Centralized auth ensures consistent behavior on server-rendered and client-navigated requests.
Testing
Hook-based auth is easier to test in isolation than scattered per-page checks.
Quick Check
Where should you do route protection?
Recap
Centralize route protection in handle, checking locals.user and redirecting unauthorized requests.
Frequently asked questions
Is the “Protected Routes in handle() Hook” lesson free?
Yes — the full text of “Protected Routes in handle() Hook” is free to read here on the web, and the Sveltejs Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Sveltejs Academy course, upgrade to CoddyKit PRO.
What will I learn in “Protected Routes in handle() Hook”?
Redirect unauthenticated users from protected routes inside the handle hook. You practise Sveltejs Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Sveltejs Academy?
No prior experience is required. Sveltejs Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Protected Routes in handle() Hook” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Sveltejs Academy lesson?
Yes. Every Sveltejs Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Cookie-Based Sessions
- JWT in HTTP-Only Cookies
- Protected Routes in handle() Hook
- OAuth with SvelteKit and Lucia Auth