When should a Next.js route return not found, redirect, forbidden, or an error?

For Route Handlers I usually express authentication and authorization with suitable HTTP responses rather than redirecting an API client to a login page. For HTML routes, a login redirect may preserve a validated local return path, while forbidden access can show a dedicated UI. Sometimes a protected resource deliberately returns not found to avoid confirming its existence, but that is a documented security policy rather than accidental inconsistency. Redirects are kept out of broad catch blocks because framework control-flow helpers throw internally.