How would you implement role-based rendering on the server without exposing protected routes to the client?

Implementing role-based rendering without exposing protected content requires shifting authorization completely to the server. The fundamental principle is that unauthorized users should never receive the JavaScript code or markup for protected routes. This is achieved through a defense-in-depth strategy: middleware provides fast edge-level filtering, Server Components perform database-backed permission checks, and architectural patterns ensure that admin-only code never reaches unauthorized clients. Critical vulnerabilities like CVE-2025-29927 (CVSS 9.1) have demonstrated that relying solely on middleware can be dangerous, making layered validation essential .

Middleware provides the first line of defense, running at the edge before requests reach your pages. It can quickly validate JWTs and redirect unauthenticated users, but should not be the only protection. The CVE-2025-29927 vulnerability showed that attackers could bypass middleware entirely by manipulating headers, so middleware checks must be complemented by deeper validation . Use middleware for fast, coarse-grained routing decisions like redirecting logged-out users or rewriting requests based on basic role claims .

The critical layer of protection happens in Server Components themselves. After middleware, the request reaches your page component where you must verify authorization again—this time with full database access. The Next.js documentation emphasizes that authorization should be enforced at the data access layer, where you can verify permissions against your database rather than just token claims . This prevents token tampering and ensures that revoked permissions are immediately enforced.

Next.js 15.1 introduced an experimental forbidden() function that throws an error rendering a 403 page . This provides a semantic way to handle authorization failures. To use it, enable the authInterrupts flag in your config. The forbidden() function can be called in Server Components, Server Actions, and Route Handlers, and pairs with a custom forbidden.js file for branded error pages .

The final and most critical layer is authorization at the data level. Even if a user bypasses page-level checks, they should never be able to access data they don't own. Create a dedicated Data Access Layer (DAL) that enforces permissions for every database query . This ensures that even if an attacker finds a way to call internal functions, authorization is still enforced.

A critical but often overlooked aspect is preventing admin code from reaching client bundles. Even if you protect routes, if admin components are imported in shared layouts, their JavaScript may still be sent to users . The solution is architectural separation: keep admin pages in their own route group with separate layouts, and never import admin-only code in user-facing components. Use route groups like (admin) and (user) to create clear boundaries .

A important security consideration is whether to return 404 (Not Found) or 403 (Forbidden) for unauthorized access. Returning 404 for protected routes provides better security through obscurity—attackers cannot distinguish between non-existent routes and protected ones . However, returning explicit 403 errors can be useful for debugging and providing clear user feedback. The experimental forbidden() function provides a semantic way to return 403 when you want explicit denial .