SvelteKit Example

Acro · 2025-02-09T05:14:44.976Z

I was planning to do auth path check in `hooks.server.ts`, but don’t think I can with the `svelteKitHandler` So looks like what I need to do for SvelteKit, is do this on the root `layout.server.ts` and pass the session down. `await parent()` And do path check on each page or layout with the `session` passed down. I hope there is a way to use the `auth.api` in `hooks.server.ts` instead. I planned on assigning the `auth.api` to `event.locals` Cause I’m assuming you can’t use the `auth.api` before the `svelteKitHander`. Inspired by: https://youtu.be/K1Tya6ovVOI?feature=shared Would love an example of this with Better Auth.

B

battlesheep123•2/9/25, 10:08 AM

Of course, you can use

hooks.server.ts

hooks.server.ts

to check the session.

You could use e.g. something like the following:

const response = await auth.api.getSession({
    headers: new Headers(event.request.headers),
});
    
event.locals.session = response?.session;
event.locals.user = response?.user;

const response = await auth.api.getSession({
    headers: new Headers(event.request.headers),
});
    
event.locals.session = response?.session;
event.locals.user = response?.user;

const response = await auth.api.getSession({
    headers: new Headers(event.request.headers),
});
    
event.locals.session = response?.session;
event.locals.user = response?.user;

const response = await auth.api.getSession({
    headers: new Headers(event.request.headers),
});
    
event.locals.session = response?.session;
event.locals.user = response?.user;

R

Robi•2/9/25, 1:01 PM

or if you're using just the client and the instance isnt on your sveltekit but on an express server somewhere else

hooks.server.ts

import type { Handle } from '@sveltejs/kit';

export const handle: Handle = async ({ event, resolve }) => {

  const session = await authClient.getSession({
    fetchOptions: {
      headers: event.request.headers
    }
  });

  event.locals.session = session?.data?.session;
  event.locals.user = session?.data?.user;

  const response = await resolve(event);
  return response;
};

import type { Handle } from '@sveltejs/kit';

export const handle: Handle = async ({ event, resolve }) => {

  const session = await authClient.getSession({
    fetchOptions: {
      headers: event.request.headers
    }
  });

  event.locals.session = session?.data?.session;
  event.locals.user = session?.data?.user;

  const response = await resolve(event);
  return response;
};

import type { Handle } from '@sveltejs/kit';

export const handle: Handle = async ({ event, resolve }) => {

  const session = await authClient.getSession({
    fetchOptions: {
      headers: event.request.headers
    }
  });

  event.locals.session = session?.data?.session;
  event.locals.user = session?.data?.user;

  const response = await resolve(event);
  return response;
};

import type { Handle } from '@sveltejs/kit';

export const handle: Handle = async ({ event, resolve }) => {

  const session = await authClient.getSession({
    fetchOptions: {
      headers: event.request.headers
    }
  });

  event.locals.session = session?.data?.session;
  event.locals.user = session?.data?.user;

  const response = await resolve(event);
  return response;
};

then to protect a route ( anything in (admin) for example )

import type { LayoutServerLoad } from './$types';
import { error, redirect } from '@sveltejs/kit';

export const load: LayoutServerLoad = async ({ locals }) => {

    console.log('Admin Layout Server load ');

    const session = locals.session;
    const user = locals.user;

    if (!session) {
        console.log('Admin : No session');
        throw redirect(302, '/login');
    }
    if (user?.role !== 'admin') {
        console.log('Admin : Not admin');
        throw error(403, 'Forbidden');
    }
};

import type { LayoutServerLoad } from './$types';
import { error, redirect } from '@sveltejs/kit';

export const load: LayoutServerLoad = async ({ locals }) => {

    console.log('Admin Layout Server load ');

    const session = locals.session;
    const user = locals.user;

    if (!session) {
        console.log('Admin : No session');
        throw redirect(302, '/login');
    }
    if (user?.role !== 'admin') {
        console.log('Admin : Not admin');
        throw error(403, 'Forbidden');
    }
};

import type { LayoutServerLoad } from './$types';
import { error, redirect } from '@sveltejs/kit';

export const load: LayoutServerLoad = async ({ locals }) => {

    console.log('Admin Layout Server load ');

    const session = locals.session;
    const user = locals.user;

    if (!session) {
        console.log('Admin : No session');
        throw redirect(302, '/login');
    }
    if (user?.role !== 'admin') {
        console.log('Admin : Not admin');
        throw error(403, 'Forbidden');
    }
};

import type { LayoutServerLoad } from './$types';
import { error, redirect } from '@sveltejs/kit';

export const load: LayoutServerLoad = async ({ locals }) => {

    console.log('Admin Layout Server load ');

    const session = locals.session;
    const user = locals.user;

    if (!session) {
        console.log('Admin : No session');
        throw redirect(302, '/login');
    }
    if (user?.role !== 'admin') {
        console.log('Admin : Not admin');
        throw error(403, 'Forbidden');
    }
};

Bbattlesheep123 Of course, you can use `hooks.server.ts` to check the session. You could use e....

A

AcroOP•2/18/25, 3:00 AM

Where is SvelteKitHandler in this?

RRobi or if you're using just the client and the instance isnt on your sveltekit but o...

A

AcroOP•2/18/25, 3:01 AM

Ideally wanted to do these route checks in hooks.server.ts

AAcro Ideally wanted to do these route checks in hooks.server.ts

R

Robi•2/18/25, 6:23 AM

You can get the url and throw redirects from the hook with this method too , no ?