Next.js · Authorize every server-side mutation
A hidden button is not an authorization boundary.
Prerequisite: Next.js App Router, sessions and SQL · 45 minutes of guided study
One focused engineering workshop with project code, failure scenarios and a manual review checklist. This is not a complete language or framework course.
Start first lesson →What you’ll be able to do
- A hidden button is not an authorization boundary.
How to study this course
Follow the numbered modules. Read the example, explain why it works, attempt the exercise, then compare your result with the supplied checks.
Setup: Use the project environment specified in each lesson. These workshops record your own review.
Times estimate guided reading and practice. Projects and revision can take longer.