Comparison questionHard~10 min

Interview question

When should a Next.js route return not found, redirect, forbidden, or an error?

Separates missing resources, canonical navigation, authorization outcomes, expected failures, and unexpected exceptions.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I use notFound() when the requested public resource does not exist, and redirect() when another URL is the correct next location or canonical destination. A missing session is an authentication outcome and insufficient permission is an authorization outcome; experimental unauthorized() and forbidden() require authInterrupts, so I do not present them as universally stable defaults. Unexpected failures are thrown to an error boundary, while ordinary validation errors are returned as expected data.

Full answer below

Practice focus

notFound, redirect, unauthorized and forbidden behavior, expected errors, exceptions, APIs, and information disclosure.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
These outcomes express different product and HTTP semantics; choosing one merely because it changes the UI creates confusing behavior.
I use notFound() when the requested public resource does not exist, and redirect() when another URL is the correct next location or canonical destination. A missing session is an authentication outcome and insufficient permission is an authorization outcome; experimental unauthorized() and forbidden() require authInterrupts, so I do not present them as universally stable defaults. Unexpected failures are thrown to an error boundary, while ordinary validation errors are returned as expected data.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
For Route Handlers I usually express authentication and authorization with suitable HTTP responses rather than redirecting an API client to a login page. For HTML routes, a login redirect may preserve a validated local return path, while forbidden access can show a dedicated UI. Sometimes a protected resource deliberately returns not found to avoid confirming its existence, but that is a documented security policy rather than accidental inconsistency. Redirects are kept out of broad catch blocks because framework control-flow helpers throw internally.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
I define the outcome matrix per entry point: public page, authenticated page, mutation, and API. Observability records the internal reason without leaking it into a user-facing message, and metrics distinguish genuine 404s from denied access and server faults. Canonical redirects avoid loops and preserve only safe query parameters. Tests cover direct requests, client navigation, crawlers, expired sessions, cross-tenant IDs, and unexpected dependencies so status, rendered UI, cache behavior, and disclosure remain aligned.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Returning 200 with an empty page for a missing public resource.
Redirecting every API authorization failure to HTML login.
Catching framework redirect control flow as an ordinary exception.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

A forbidden response reveals whether another tenant owns an ID.
Experimental auth APIs are described as unconditional stable behavior.
Expected validation failures trigger global error pages.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

When might forbidden become not found?
Why avoid redirecting API clients?
How are expected errors different from exceptions?

Continue practice

Move to the linked follow-up, next path step, prerequisite, or deeper variant.

1 linked

Next interviewer turn

Continue the conversation with a linked follow-up drill.

App Router auth boundariesMaps authenticated and authorized decisions to route outcomes.

Practice route

Read core answer Review checklist Follow-up prompts Track progress

Finished this drill?

Practice freely. Sign in only when you want to save completion, confidence, notes, or bookmarks.

New to Aporeon? Create account

Drill details

Human editorial direction

Aporeon is shaped by Aleksandar Tomovski, a software developer with experience on both sides of technical interviews. Content is reviewed for accuracy, natural spoken delivery, useful depth, and honest trade-offs.

About the creator Editorial standards

Was this drill useful?

Help improve the interview library.

Found this answer useful?

Say thanks with a standalone, one-time $5 contribution. No account required.

No subscription or perks.Choose another amount

Opening drill

Comparison questionHard~10 min

Interview question

When should a Next.js route return not found, redirect, forbidden, or an error?

Separates missing resources, canonical navigation, authorization outcomes, expected failures, and unexpected exceptions.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

notFound, redirect, unauthorized and forbidden behavior, expected errors, exceptions, APIs, and information disclosure.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
These outcomes express different product and HTTP semantics; choosing one merely because it changes the UI creates confusing behavior.
I use notFound() when the requested public resource does not exist, and redirect() when another URL is the correct next location or canonical destination. A missing session is an authentication outcome and insufficient permission is an authorization outcome; experimental unauthorized() and forbidden() require authInterrupts, so I do not present them as universally stable defaults. Unexpected failures are thrown to an error boundary, while ordinary validation errors are returned as expected data.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
For Route Handlers I usually express authentication and authorization with suitable HTTP responses rather than redirecting an API client to a login page. For HTML routes, a login redirect may preserve a validated local return path, while forbidden access can show a dedicated UI. Sometimes a protected resource deliberately returns not found to avoid confirming its existence, but that is a documented security policy rather than accidental inconsistency. Redirects are kept out of broad catch blocks because framework control-flow helpers throw internally.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
I define the outcome matrix per entry point: public page, authenticated page, mutation, and API. Observability records the internal reason without leaking it into a user-facing message, and metrics distinguish genuine 404s from denied access and server faults. Canonical redirects avoid loops and preserve only safe query parameters. Tests cover direct requests, client navigation, crawlers, expired sessions, cross-tenant IDs, and unexpected dependencies so status, rendered UI, cache behavior, and disclosure remain aligned.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Returning 200 with an empty page for a missing public resource.
Redirecting every API authorization failure to HTML login.
Catching framework redirect control flow as an ordinary exception.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

A forbidden response reveals whether another tenant owns an ID.
Experimental auth APIs are described as unconditional stable behavior.
Expected validation failures trigger global error pages.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

When might forbidden become not found?
Why avoid redirecting API clients?
How are expected errors different from exceptions?

Continue practice

Move to the linked follow-up, next path step, prerequisite, or deeper variant.

1 linked

Next interviewer turn

Continue the conversation with a linked follow-up drill.

App Router auth boundariesMaps authenticated and authorized decisions to route outcomes.

When should a Next.js route return not found, redirect, forbidden, or an error?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Next interviewer turn

When should a Next.js route return not found, redirect, forbidden, or an error?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Next interviewer turn