Architecture scenarioHard~12 minNext.js App Router Composition & Actions / 10 of 10

Interview question

Where should authentication and authorization happen in an App Router application?

Layers optimistic routing checks with secure data-layer authorization across components, actions, and handlers.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I centralize session verification and authorization in a server-only data-access layer and call it close to every protected read or write. Server Components verify before returning sensitive data, Server Actions authorize each mutation, and Route Handlers authorize each request. Proxy can perform a quick cookie-based redirect for user experience, but it is not the final security boundary.

Full answer below

Practice focus

Authentication, authorization, DAL design, Server Components, Server Actions, Route Handlers, Proxy, and caching.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
App Router applications have multiple executable entry points, so no layout or Proxy check can secure them all by itself.
I centralize session verification and authorization in a server-only data-access layer and call it close to every protected read or write. Server Components verify before returning sensitive data, Server Actions authorize each mutation, and Route Handlers authorize each request. Proxy can perform a quick cookie-based redirect for user experience, but it is not the final security boundary.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
A layout may hide navigation for an anonymous user, yet nested routes and actions can still be invoked independently, so layout-only checks are insufficient. The DAL returns minimal DTOs after authorization and can deduplicate session work during one render pass. I distinguish unauthenticated from authenticated-but-forbidden outcomes and avoid redirecting an API caller to HTML unexpectedly. Database-backed checks are used for sensitive permissions because roles and sessions can change after a cookie was issued.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
I model tenant and resource authorization, not just global roles, and ensure every query is scoped by trusted identity before it can return rows. Cache entries containing user data are request-safe and never keyed only by a public URL. Proxy matchers avoid assets and unnecessary expensive work, while secure checks remain correct if Proxy is bypassed. Tests call pages, actions, and handlers directly with missing, expired, forged, cross-tenant, and downgraded sessions, then verify both response behavior and absence of leaked data.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Relying on a protected layout to secure every child entry point.
Using Proxy as the only authorization check.
Caching personalized data under a shared key.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

A Server Action trusts that only the visible button can invoke it.
Tenant scoping is performed after loading the record.
An API returns a login HTML page instead of a suitable status.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Why are layout checks insufficient?
What belongs in Proxy?
How do you cache session verification safely?

Continue practice

Move to the linked follow-up, next path step, prerequisite, or deeper variant.

1 linked

Prerequisite

Review this first if the current drill feels shaky.

Secure Server ActionGeneralizes secure identity checks across every App Router entry point.

Practice route

Read core answer Review checklist Follow-up prompts Track progress

Finished this drill?

Practice freely. Sign in only when you want to save completion, confidence, notes, or bookmarks.

New to Aporeon? Create account

Drill details

Human editorial direction

Aporeon is shaped by Aleksandar Tomovski, a software developer with experience on both sides of technical interviews. Content is reviewed for accuracy, natural spoken delivery, useful depth, and honest trade-offs.

About the creator Editorial standards

Was this drill useful?

Help improve the interview library.

Found this answer useful?

Say thanks with a standalone, one-time $5 contribution. No account required.

No subscription or perks.Choose another amount

Opening drill

Architecture scenarioHard~12 minNext.js App Router Composition & Actions / 10 of 10

Interview question

Where should authentication and authorization happen in an App Router application?

Layers optimistic routing checks with secure data-layer authorization across components, actions, and handlers.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

Authentication, authorization, DAL design, Server Components, Server Actions, Route Handlers, Proxy, and caching.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
App Router applications have multiple executable entry points, so no layout or Proxy check can secure them all by itself.
I centralize session verification and authorization in a server-only data-access layer and call it close to every protected read or write. Server Components verify before returning sensitive data, Server Actions authorize each mutation, and Route Handlers authorize each request. Proxy can perform a quick cookie-based redirect for user experience, but it is not the final security boundary.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
A layout may hide navigation for an anonymous user, yet nested routes and actions can still be invoked independently, so layout-only checks are insufficient. The DAL returns minimal DTOs after authorization and can deduplicate session work during one render pass. I distinguish unauthenticated from authenticated-but-forbidden outcomes and avoid redirecting an API caller to HTML unexpectedly. Database-backed checks are used for sensitive permissions because roles and sessions can change after a cookie was issued.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
I model tenant and resource authorization, not just global roles, and ensure every query is scoped by trusted identity before it can return rows. Cache entries containing user data are request-safe and never keyed only by a public URL. Proxy matchers avoid assets and unnecessary expensive work, while secure checks remain correct if Proxy is bypassed. Tests call pages, actions, and handlers directly with missing, expired, forged, cross-tenant, and downgraded sessions, then verify both response behavior and absence of leaked data.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Relying on a protected layout to secure every child entry point.
Using Proxy as the only authorization check.
Caching personalized data under a shared key.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

A Server Action trusts that only the visible button can invoke it.
Tenant scoping is performed after loading the record.
An API returns a login HTML page instead of a suitable status.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Why are layout checks insufficient?
What belongs in Proxy?
How do you cache session verification safely?

Continue practice

Move to the linked follow-up, next path step, prerequisite, or deeper variant.

1 linked

Prerequisite

Review this first if the current drill feels shaky.

Secure Server ActionGeneralizes secure identity checks across every App Router entry point.

Where should authentication and authorization happen in an App Router application?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Prerequisite

Where should authentication and authorization happen in an App Router application?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Prerequisite