Protective routes

Clarify the security boundary

Ask whether this means client-side navigation guards, API authorization, role-based access, or all three. A UI route guard improves experience by checking the current session and redirecting an unauthenticated visitor, but it is never the protection boundary: an attacker can call the API directly. On the server, authenticate a signed session or token, load the minimum needed claims, then authorize the requested resource and action before returning data. Make deny responses consistent, avoid revealing whether another user's resource exists, and refresh or revoke sessions deliberately. Route matching is usually O(segments) and authorization lookup is typically O(1) or indexed O(log n); security correctness matters more than that cost. Test expired sessions, direct deep links, role changes, IDOR attempts, logout across tabs, and redirect loops.