Protected route handlers call a session getter

A file inside app/(authenticated)/ or app/admin/ that never calls getServerSession(), auth(), or an equivalent session getter is unprotected — the directory name is a routing convention, not a security boundary. CWE-862 (Missing Authorization) and OWASP A01 (Broken Access Control) describe this exactly. An unauthenticated user who discovers the route URL gets full access. This pattern is extremely common in AI-generated code because the model groups files into protected directories without always wiring the session check inside each file.

Call the session getter at the top of every protected route handler and redirect or return 401 immediately if the result is null.

// app/admin/users/page.tsx
import { auth } from '@/lib/auth'
import { redirect } from 'next/navigation'

export default async function Page() {
  const session = await auth()
  if (!session?.user || session.user.role !== 'admin') {
    redirect('/login')
  }
  const users = await prisma.user.findMany()
  return <UserList users={users} />
}

For API routes, return a 401 instead of redirecting. Do not rely on directory grouping in the App Router as a security mechanism — it affects routing only, not authentication.