Where auth actually runs

Short guides, each checked against the framework's own docs

Some auth checks look like they protect a route and don't, because the framework runs the route before, or without, the code that checks. Each guide answers one question, shows the failing setup and the fix, and cites the docs that explain why.

Does an auth check in +layout.server.ts protect SvelteKit form actions?
No. Actions run before load functions, and layouts have no effect on +server endpoints. Use the handle hook or check in each action.
SvelteKit 2
Does a parent loader's auth check protect child routes in React Router?
No. Loaders run in parallel and a submission runs the action first. Check in each loader and action, or use route middleware.
React Router 7 · Remix 2
Is your Next.js middleware protecting your API routes?
Only where its matcher and branches reach, and only if it blocks. Verify the session in each route handler.
Next.js 13–16

Check your own routes

CodeDiag finds the routes in a Next.js, SvelteKit, React Router, Express, Fastify, Hono, Elysia, NestJS, or tRPC app that have no recognizable auth check or input validation. It runs locally and needs no account.

$ npx @sabahattink/codediag scan .