Qwik City lazy-loaded route chunks exposed without authorization guards

Preventing Unauthorized Access to Route Chunks

To prevent unauthenticated users from requesting lazy-loaded chunks, you must implement a dual-layer defense: route loader guards to block client-side navigation and server-side middleware to block direct URL access to the static JavaScript files.

1. Blocking Client-Side Navigation (The Loader Guard)

Qwik City executes the routeLoader$ on the server before the browser attempts to fetch the component's dynamic import. By throwing a redirect in the loader, you prevent the client-side loader from ever initiating the request for the route's chunk.

import { routeLoader$, redirect } from '@builder.io/qwik-city';

export const useProtectedRouteLoader = routeLoader$(async ({ cookies }) => {
  const session = cookies.get('session');
  if (!session) {
    throw redirect(302, '/login');
  }
  return { authenticated: true };
});

2. Blocking Direct URL Access (Server-Side Middleware)

Because route chunks are served as static assets, a user who knows the chunk's URL (e.g., /_app/route-xyz.js) can bypass the loader guard. To stop this, you must intercept requests at the server level before they reach the static file handler.

• Custom Server (Express/Fastify): Implement a middleware that checks the request path. If the path matches a pattern for protected chunks and the session is invalid, return a 403 Forbidden.
• Default Qwik Server: Use a request handler or plugin to inspect the Request object.

Implementation Strategy

Layer	Mechanism	Prevents	Result
Application	routeLoader$	UI Navigation	Redirect to /login
Infrastructure	Server Middleware	Direct URL Access	403 Forbidden

Verification Steps

1. Test Navigation: Log out and navigate to a protected route. Verify the browser redirects to /login and no .js chunks for that route appear in the Network tab.
2. Test Direct Access: Copy a chunk URL from an authenticated session. Log out and paste that URL directly into the address bar. The server should return a 403 or 401 response.

Assumptions and Constraints

This approach assumes you are using a session-based authentication system (e.g., cookies) that the server can validate independently of the Qwik component lifecycle. If you are using a third-party CDN to serve chunks, you must implement authorization at the CDN edge (e.g., Lambda@Edge or Cloudflare Workers) as the Qwik server will be bypassed entirely.

Missing Detail: Are your static assets served via the Qwik server or a separate CDN/Object Store?