How to Create Protected Pages
Restrict routes to signed-in users properly — including the server-side check most AI-generated guards miss.
Published 24 Aug 2026 · Tested with Lovable as of 24 Aug 2026
Overview
A protected page has two halves: hiding the UI from signed-out visitors, and refusing to return their data from the server. Only the second one is real security.
Beginner explanation: Hiding a page is like hiding a door. Locking the data is like locking the door.
Technical explanation: Route guards handle the user experience. Access rules on the database and authentication checks in server code handle the security. You need both.
Steps
- Group protected pages under a single authenticated area.
- Redirect signed-out visitors to the sign-in page.
- Make sure every data read for those pages is authenticated server-side.
- Confirm database access rules limit rows to the signed-in owner.
- Test by signing out and visiting the URL directly.
:::tip Try to load a protected page URL directly in a private window. If you see any real data, the protection is cosmetic. :::
What to check afterwards
- Direct URL access while signed out redirects
- No private data appears in the page source
- Another user cannot load your rows
Common problems
- Client-side-only guards. The data endpoint is still open.
- Guarding a page but not the query behind it.
- Redirect loops on refresh caused by checking the session before it has loaded.
Where people get stuck
If you have followed the steps and the result still is not right, the fastest path is usually to describe the exact behaviour you expected, the behaviour you got, and any error text, then ask for a fix in one focused follow-up prompt. If that loop is not converging, hand it over.
Prompts that pair with this guide
Add Authentication With Email and Google
Sign-up, sign-in, sign-out, session handling and protected routes in one pass.
Copy this prompt →Add Role-Based User Permissions
Creates a safe role system stored in its own table, with a role-check function used by your access rules and server actions.
Copy this prompt →Related guides
How to Add User Roles and Permissions
Admin, editor and member roles done safely — stored separately from user profiles so they cannot be escalated.
How to Add User Login to a Lovable Project
Sign-up, sign-in, sign-out and sessions — plus the settings people forget that break login on the live site.
