{"id":16792609,"url":"https://github.com/ivanhofer/sveltekit-auth","last_synced_at":"2026-03-03T07:45:11.173Z","repository":{"id":65363061,"uuid":"590902177","full_name":"ivanhofer/sveltekit-auth","owner":"ivanhofer","description":null,"archived":false,"fork":false,"pushed_at":"2023-01-21T09:03:39.000Z","size":32,"stargazers_count":3,"open_issues_count":2,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-10T23:52:37.770Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ivanhofer.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2023-01-19T13:39:16.000Z","updated_at":"2025-03-04T13:30:06.000Z","dependencies_parsed_at":"2023-02-12T08:40:11.377Z","dependency_job_id":null,"html_url":"https://github.com/ivanhofer/sveltekit-auth","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ivanhofer/sveltekit-auth","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivanhofer%2Fsveltekit-auth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivanhofer%2Fsveltekit-auth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivanhofer%2Fsveltekit-auth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivanhofer%2Fsveltekit-auth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ivanhofer","download_url":"https://codeload.github.com/ivanhofer/sveltekit-auth/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivanhofer%2Fsveltekit-auth/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30036181,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-03T06:58:30.252Z","status":"ssl_error","status_checked_at":"2026-03-03T06:58:15.329Z","response_time":61,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T08:46:32.649Z","updated_at":"2026-03-03T07:45:11.146Z","avatar_url":"https://github.com/ivanhofer.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# `SvelteKit` using `+auth.server.ts` example\n\nThis is a repository demonstrating a solution to the current difficulties using authorization in `SvelteKit` as [discussed here](https://github.com/sveltejs/kit/issues/6315).\n\nI want to showcase the pain points of dealing with authorization in more complex applications.\n\n## Proposed Solution\nThe solution forsees that `SvelteKit` should offer a built-in way to handle authorization. Key-aspects are:\n\n - a new file `+auth.server.ts` that exports a `guard` function\n - when visiting a page, all `+auth.server.ts` guards of the current route will run (all parents)\n - guards should run in sequence from top to bottom of the folder tree\n - all guards will run before any `+layout` and `+page` files\n - if a guard throws, no `+layout` and `+page` `load`s get executed that are on the current level or below the guard that throws\n - parent `+layout` files will run after a guard throws and should have the same error-handling behavior as if the `load` function inside the co-located `+layout` file would throw in it's first line.\n - all guards will also run before [form actions](https://kit.svelte.dev/docs/form-actions) and [`RequestHandler`s](https://kit.svelte.dev/docs/routing#server) (`POST`, `DELETE`, etc.)\n - using `+auth.server.ts` should be completely optional. If someone does only need basics, he can probably handle it in `hooks.server.ts`.\n\n\u003e Those are the points I would consider. This is just a proposal and the naming and details are open to discuss.\n\n## Implementation\n\nThe [`main`](https://github.com/ivanhofer/sveltekit-auth/tree/main)-branch implements an example with the current version of `SvelteKit` and tries to demonstrate what you need to consider when you try to use authorization in an application. I have identified 10 issues, you need to consider when you really want to make sure to protect your application (search for 'potential issue:').\n\nThe [`rfc`](https://github.com/ivanhofer/sveltekit-auth/tree/rfc)-branch wants to show how you would write your application using the `+auth.server.ts` approach mentioned above.\n\u003e Note: the routes will not actually be protected when you try to run this example, because `+auth.server.ts` is just a concept for now.\n\nThis [PR](https://github.com/ivanhofer/sveltekit-auth/pull/2) shows the differences of both approaches.\n\n\n## Contributing\n\nIf you know other benefits (or downsides) to this approach, feel free to open an issue or a PR to demonstrate it in both branches.\n\n## Other Solutions\n\n - Handle authorization inside `hooks.server.ts`:\\\n\tTry to convert this example to that approach and tell me if you still think this is a good idea ;)\n - Leaving it as it currently is\\\n\tIt is really hard to make sure that your application is 100% protected. Giving developers a good solution, will improve the quality of `SvelteKit` applications.\n - Let someone else implement this as a `vite`-plugin\\\n\tThis could also be an option, but an official way would certainly be the better options\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fivanhofer%2Fsveltekit-auth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fivanhofer%2Fsveltekit-auth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fivanhofer%2Fsveltekit-auth/lists"}