Bug: 401 console error on protected routes before auth redirect #153

New issue

Closed

opened 2026-03-28 21:26:12 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-03-28 21:26:12 +00:00

Owner

Type

Bug

Lineage

Discovered during spike #150 — parent login flow validation.

Repo

forgejo_admin/westside-landing

What Broke

Navigating directly to a protected route (e.g. /my-players) while unauthenticated causes the page component's onMount to fire an API call before the layout's auth guard redirects to /signin. Results in a 401 console error. Not a security issue — API correctly rejects — but noisy.

Repro Steps

Open browser dev tools console
Navigate to https://westsidekingsandqueens.tail5b443a.ts.net/my-players while not logged in
Observe: redirected to /signin (correct) but console shows 401 for /account/players

Expected Behavior

No API calls fire before auth guard determines user is unauthenticated.

Environment

Cluster/namespace: prod

Acceptance Criteria

No 401 console errors when hitting protected routes unauthenticated
Auth guard check happens before component API calls
Redirect to /signin still works

project-westside-basketball
forgejo_admin/westside-landing #150

### Type Bug ### Lineage Discovered during spike #150 — parent login flow validation. ### Repo `forgejo_admin/westside-landing` ### What Broke Navigating directly to a protected route (e.g. `/my-players`) while unauthenticated causes the page component's `onMount` to fire an API call before the layout's auth guard redirects to `/signin`. Results in a 401 console error. Not a security issue — API correctly rejects — but noisy. ### Repro Steps 1. Open browser dev tools console 2. Navigate to `https://westsidekingsandqueens.tail5b443a.ts.net/my-players` while not logged in 3. Observe: redirected to `/signin` (correct) but console shows 401 for `/account/players` ### Expected Behavior No API calls fire before auth guard determines user is unauthenticated. ### Environment - Cluster/namespace: prod ### Acceptance Criteria - [ ] No 401 console errors when hitting protected routes unauthenticated - [ ] Auth guard check happens before component API calls - [ ] Redirect to `/signin` still works ### Related - `project-westside-basketball` - `forgejo_admin/westside-landing #150`