Authentication and authorization boundaries

What this means

Authentication identifies a user. Authorization checks each protected server operation against trusted server data.

In beginner terms, this topic answers one practical question: "What should I write, and why does React care about it?" Do not try to memorize the syntax first. First understand the idea, then connect the syntax to that idea.

Why it matters

Client visibility is not a security boundary for Server Actions or Route Handlers.

When you build real React screens, this idea helps you decide where data should live, what the user should see, and what should happen after an interaction. That is why this lesson is part of the main path instead of being an optional detail.

Step by step

1. Notice the UI problem this topic solves. 2. Look at the smallest possible example. 3. Change one value and predict what should appear. 4. Run the example and compare the result with your prediction. 5. Use the practice task before moving on.

Small example

const user = await requireUser();

Common mistake

Do not use authentication and authorization boundaries only because it looks advanced. Start from the problem it solves.

Practice task

Change the example, predict the result, then explain the behavior in your own words.

Remember this

Authorize at the mutation and data-access boundary.