How do I restrict pages to logged-in users?
Last checked 31 Aug 2026
Short answer
Wrap the routes in a protected-route component that checks the current auth session and redirects signed-out users to login, and back this up with row-level security on any data those pages fetch.
Two layers of protection
Restricting a page is a front-end convenience; it stops honest users wandering into pages they shouldn't see, but it doesn't secure your data. You need both:
- Route guard (UI): a wrapper component that checks whether a session exists before rendering the page, redirecting to
/loginif not. - Row-level security (RLS, data): Postgres policies on your tables that only let authenticated users read/write rows they're allowed to, regardless of what the front end shows.
How to set it up
- Ask Lovable: "Add authentication with email/password and protect the /dashboard route so only logged-in users can view it."
- Lovable will generate a guard component and wire it into your router.
- Ask it to add RLS policies restricting the underlying tables to
auth.uid()matches, not just page-level checks.
Restrict the /account and /dashboard pages to signed-in users only, and add row-level security so signed-out requests can't read that data via the API either.
What usually goes wrong
- Only guarding the route, leaving the database table publicly readable — anyone with the API URL can still fetch the data.
- Guard checks running before the session finishes loading, causing a flash of redirect (see why-does-my-app-keep-redirecting-to-login).
- Forgetting server functions/edge functions also need their own auth checks — a protected page calling an open function is still a hole.
Roles vs simple login
If you need different access levels (not just logged-in vs logged-out), that's role-based access — see how-do-i-create-different-user-roles.
Sources
Was this answer helpful?
Related questions
- AnswerHow do I add password reset?Ask Lovable to add a "forgot password" flow — it uses Lovable Cloud's authentication to email a reset link and lets the user set a new password.
- AnswerHow do I add login to Lovable?Ask Lovable to add authentication — it enables Lovable Cloud (if not already on), then generates sign-up/login pages and wires them to email, Google, or other providers.
- AnswerHow do I create admin users?Add a `user_roles` table with an `admin` role, assign it to the specific user's ID, and check that role server-side (in RLS policies and any admin-only functions) rather than trusting a front-end flag.
- AnswerWhy does my app keep redirecting to login?This is almost always a session or route-guard bug: either the auth session isn't persisting, or a protected route checks auth state before it's loaded, so it bounces back to login even when signed in.
You might also need
- GuideHow to Create Protected PagesRestrict routes to signed-in users properly — including the server-side check most AI-generated guards miss.
- GuideHow to Add User Login to a Lovable ProjectSign-up, sign-in, sign-out and sessions — plus the settings people forget that break login on the live site.
- GuideHow to Add User Roles and PermissionsAdmin, editor and member roles done safely — stored separately from user profiles so they cannot be escalated.
