router-core/auth-and-guards

Protect routes in TanStack Router by adding a beforeLoad guard to your route definition that checks auth state and calls redirect() to send unauthenticated users to the login page. This mechanism safely restricts access to specific route paths.

Implement RBAC in TanStack Router by evaluating user roles and permissions inside the beforeLoad guard. You can redirect unauthorized users away from restricted routes, securing the application based on specific permission sets.

TanStack Router uses the isRedirect helper to handle redirect exceptions during beforeLoad guards. This allows you to safely manage and catch redirects thrown by route protection logic without crashing the application.

Yes, TanStack Router auth guards work with external providers like Auth0, Clerk, and Supabase. You integrate the provider's auth state into the router context, making it available to beforeLoad guards for access control decisions.

Share authentication state across loaders by storing it in the TanStack Router context. This makes the current auth status globally available to all route loaders and beforeLoad guards throughout your application routing tree.

Use an authenticated layout route, such as a pathless _authenticated route, when you need to apply a single beforeLoad guard across multiple child routes. This pattern centralizes redirect logic for unauthenticated users efficiently.